@topy-ai/maggie 0.6.7 → 0.6.9

package/README.md

@@ -179,8 +179,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.6.7 update --project . --force
-npx @topy-ai/maggie@0.6.7 cleanup --project .
+npx @topy-ai/maggie@0.6.9 update --project . --force
+npx @topy-ai/maggie@0.6.9 cleanup --project .
 ```
 
 ## MaggieDash lifecycle

package/README.zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.6.7 init --agent all
+npx @topy-ai/maggie@0.6.9 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 

package/bundled-skills/maggie-content-localization/SKILL.md

@@ -2,7 +2,7 @@
 name: maggie-content-localization
 description: Manage translation, polish, rewrite, market localization, review, stale detection, and publishing for pages, guides, posts, services, products, and categories.
 metadata:
-  version: 1.2.0
+  version: 1.3.0
 ---
 
 # Maggie Content Localization

package/bundled-skills/maggie-deployment/SKILL.md

@@ -2,7 +2,7 @@
 name: maggie-deployment
 description: Deploy and operate Maggie blog projects with Cloudflare Workers as the default target, while preserving an adapter boundary for VPS, GCP, and AWS.
 metadata:
-  version: 1.1.0
+  version: 1.3.0
 ---
 
 # Maggie Deployment
@@ -70,6 +70,20 @@ The output contains only the immutable release/current layout, systemd unit,
 Nginx reverse-proxy config, health commands and rollback command. It never
 contains credentials and never SSHs, changes DNS, restarts systemd or deploys.
 
+VPS plans include a bounded retention policy: keep two immutable releases,
+preserve the `current` target and rollback target, and review prune candidates
+before any operator executes cleanup. Generate a read-only candidate report:
+
+```bash
+python3 tools/clis/maggie_deployment.py --retention-plan \
+  --release-root /var/www/example \
+  --current-link /var/www/example/current \
+  --keep-releases 2 --output .maggie/deployment/retention-plan.json
+```
+
+The CLI never deletes release directories and never permits fewer than two
+retained releases.
+
 Validate the database release separately before a VPS migration:
 
 ```bash
@@ -81,6 +95,14 @@ The manifest must reference `DATABASE_URL` (not a literal URL), declare an
 advancing version, forward-only/idempotent policy, backup and restore commands,
 and a tested restore artifact. The validator never runs those commands.
 
+If a release depends on existing rows or seeded data, set
+`dataDependencies: true` in `.maggie/migration-manifest.json` and provide
+`.maggie/deployment/data-release.json` before deployment. The checkpoint must
+use `maggie-data-release.v1`, declare `requiredTables`, compare
+`previousCounts` and `currentCounts`, and include the release, check time, and
+`passed: true`. Deployment preflight fails closed when this evidence is absent
+or incomplete; it does not copy or mutate data.
+
 Validate and materialise scheduled jobs only after their quota and lock policy
 has been reviewed:
 

package/bundled-skills/maggie-design/SKILL.md

@@ -2,7 +2,7 @@
 name: maggie-design
 description: Design authorized interior pages, review rendered responsive layouts, or explicitly rebrand a packaged homepage/template. Use rebrand only with a named source brand and target brand.
 metadata:
-  version: 1.3.0
+  version: 1.4.0
 ---
 
 # Maggie Design

package/bundled-skills/maggie-seo-geo/SKILL.md

@@ -2,7 +2,7 @@
 name: maggie-seo-geo
 description: Plan, audit, create, rewrite, and measure content for AI CMO's paid SEO and GEO workflow. Use for topic opportunities, AI visibility, technical SEO, extractable article structure, sitemap-based rewrites, GSC readback, or SEO/GEO client reports.
 metadata:
-  version: 1.0.0
+  version: 1.1.0
 ---
 
 # Maggie SEO and GEO

package/bundled-skills/maggie-service-booking/SKILL.md

@@ -2,7 +2,7 @@
 name: maggie-service-booking
 description: Import, synchronise, validate, and design SPA service pages from a booking provider such as Fresha. Use for service catalogues, treatment variants, prices, durations, booking links, payment links, and booking-aware page generation.
 metadata:
-  version: 1.0.0
+  version: 1.1.0
 ---
 
 # Maggie Service Booking

package/bundled-tools/clis/maggie_deployment.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import argparse
 import json
 import re
+from datetime import datetime, timezone
 from pathlib import Path
 
 
@@ -57,10 +58,21 @@ def preflight(project: Path, target: str, environment: str) -> dict:
                 rollback_passed = bool(evidence.get("passed") is True and evidence.get("environment") == "production" and evidence.get("previousRelease") and evidence.get("testedAt"))
             except (OSError, json.JSONDecodeError):
                 rollback_passed = False
-        result["checks"].update({"node_runtime_declared": bool(package.get("engines", {}).get("node") or package.get("dependencies", {}).get("astro")), "start_command_or_runtime": "start" in scripts or "preview" in scripts, "stateless_or_migration_plan": True, "release_layout_declared": True, "rollback_command_declared": True, "remote_verification_pending": True, "release_plan_artifact": bool(plan_path and plan.get("release_layout") and plan.get("current_release")), "systemd_artifact": bool(systemd_text and "ExecStart=" in systemd_text and "EnvironmentFile=" in systemd_text and "NoNewPrivileges=true" in systemd_text), "nginx_artifact": bool(nginx_text and "proxy_pass" in nginx_text and "server_name" in nginx_text), "deployment_artifacts_secret_free": secret_free, "rollback_evidence": rollback_passed if environment == "production" else True})
+        migration_manifest = project / ".maggie" / "migration-manifest.json"
+        migration = {}
+        if migration_manifest.exists():
+            try:
+                migration = json.loads(migration_manifest.read_text(encoding="utf-8"))
+            except (OSError, json.JSONDecodeError):
+                migration = {}
+        data_path = project / ".maggie" / "deployment" / "data-release.json"
+        data_required = bool(migration.get("dataDependencies"))
+        data_checkpoint = validate_data_checkpoint(data_path) if data_path.exists() else {"passed": not data_required, "declared": False, "errors": ["data-release.json is required for a data-dependent release"] if data_required else []}
+        retention_ok = bool(plan.get("retention", {}).get("keep") in (2, 3, 4, 5) and plan.get("retention", {}).get("prune") and plan.get("retention", {}).get("preserve"))
+        result["checks"].update({"node_runtime_declared": bool(package.get("engines", {}).get("node") or package.get("dependencies", {}).get("astro")), "start_command_or_runtime": "start" in scripts or "preview" in scripts, "stateless_or_migration_plan": True, "release_layout_declared": True, "rollback_command_declared": True, "release_retention_policy": retention_ok, "data_release_checkpoint": data_checkpoint["passed"], "remote_verification_pending": True, "release_plan_artifact": bool(plan_path and plan.get("release_layout") and plan.get("current_release")), "systemd_artifact": bool(systemd_text and "ExecStart=" in systemd_text and "EnvironmentFile=" in systemd_text and "NoNewPrivileges=true" in systemd_text), "nginx_artifact": bool(nginx_text and "proxy_pass" in nginx_text and "server_name" in nginx_text), "deployment_artifacts_secret_free": secret_free, "rollback_evidence": rollback_passed if environment == "production" else True})
         result["vps"] = {"runtime":"Node.js standalone","reverseProxy":"Nginx","processManager":"systemd","releaseLayout":"/var/www/<site>/releases/<release> + current symlink","dns":"Cloudflare DNS or registrar DNS; verify apex and www separately","remoteCommands":["npm ci","npm run build","systemctl restart <service>","systemctl is-active <service>","curl -fsS https://<domain>/robots.txt","curl -fsS https://<domain>/sitemap.xml"],"handoverFields":["host","sshUser","domain","service","release","previousRelease","nginxConfig","migrationVersion","verification","rollback"]}
         result["next_action"] = "review VPS host, SSH user, domain/DNS, systemd service, Nginx config, release path, migrations, and rollback owner before execute"
-        result["blocking_checks"] = ["package_manifest", "build_command", "env_example", "node_runtime_declared", "start_command_or_runtime", "stateless_or_migration_plan", "release_layout_declared", "rollback_command_declared", "release_plan_artifact", "systemd_artifact", "nginx_artifact", "deployment_artifacts_secret_free", "rollback_evidence"]
+        result["blocking_checks"] = ["package_manifest", "build_command", "env_example", "node_runtime_declared", "start_command_or_runtime", "stateless_or_migration_plan", "release_layout_declared", "rollback_command_declared", "release_retention_policy", "data_release_checkpoint", "release_plan_artifact", "systemd_artifact", "nginx_artifact", "deployment_artifacts_secret_free", "rollback_evidence"]
     else:
         result["blocking_checks"] = ["package_manifest", "build_command", "env_example"]
     return result
@@ -85,6 +97,7 @@ def vps_plan(domain: str, service: str, release_root: str, node_port: int) -> di
         "current_release": current,
         "node_port": node_port,
         "release_layout": f"{root}/releases/<immutable-release> plus current symlink",
+        "retention": {"keep": 2, "preserve": [current, f"{root}/releases/<previous-release>"], "prune": f"find {root}/releases -mindepth 1 -maxdepth 1 -type d -printf '%T@ %p\\n' | sort -nr | tail -n +3 | cut -d' ' -f2- | xargs -r rm -rf --"},
         "staging_first": True,
         "secrets": "external environment file; no secrets in generated artifacts",
         "commands": {
@@ -101,6 +114,38 @@ def vps_plan(domain: str, service: str, release_root: str, node_port: int) -> di
     }
 
 
+def validate_data_checkpoint(path: Path) -> dict:
+    try:
+        value = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        return {"passed": False, "declared": True, "errors": [f"data checkpoint unreadable: {exc}"]}
+    required = value.get("requiredTables")
+    previous = value.get("previousCounts")
+    current = value.get("currentCounts")
+    errors = []
+    if value.get("schemaVersion") != "maggie-data-release.v1": errors.append("data checkpoint schemaVersion is unsupported")
+    if value.get("passed") is not True: errors.append("data checkpoint is not passed")
+    if not isinstance(required, list) or not required: errors.append("requiredTables must be a non-empty list")
+    if not isinstance(previous, dict) or not isinstance(current, dict): errors.append("previousCounts and currentCounts are required")
+    if isinstance(required, list) and isinstance(current, dict):
+        missing = [table for table in required if table not in current]
+        if missing: errors.append("currentCounts is missing required tables")
+    if not value.get("release") or not value.get("checkedAt"): errors.append("release and checkedAt are required")
+    return {"passed": not errors, "declared": True, "errors": errors}
+
+
+def retention_plan(release_root: str, current_link: str, keep: int) -> dict:
+    if keep < 2 or keep > 5:
+        raise ValueError("keep must be between 2 and 5")
+    root = Path(release_root).resolve()
+    releases = sorted((path for path in root.iterdir() if path.is_dir() and not path.is_symlink()), key=lambda path: path.stat().st_mtime, reverse=True) if root.is_dir() else []
+    current_target = Path(current_link).resolve() if Path(current_link).exists() else None
+    preserved = {str(current_target)} if current_target else set()
+    preserved.update(str(path) for path in releases[:keep])
+    candidates = [str(path) for path in releases if str(path) not in preserved]
+    return {"schemaVersion": "maggie-retention-plan.v1", "releaseRoot": str(root), "currentLink": str(Path(current_link)), "keep": keep, "preserved": sorted(preserved), "candidates": candidates, "mutation": "not executed", "generatedAt": datetime.now(timezone.utc).isoformat()}
+
+
 def write_vps_plan(output_dir: Path, plan: dict) -> None:
     output_dir.mkdir(parents=True, exist_ok=True)
     domain = plan["domain"]
@@ -158,6 +203,9 @@ def main() -> int:
     parser.add_argument("--release-root", default="/var/www/maggie-site", help="immutable release root")
     parser.add_argument("--node-port", type=int, default=4321)
     parser.add_argument("--plan-dir", help="directory for generated VPS artifacts")
+    parser.add_argument("--retention-plan", action="store_true", help="create a read-only release prune candidate plan")
+    parser.add_argument("--current-link", help="current symlink for --retention-plan")
+    parser.add_argument("--keep-releases", type=int, default=2)
     args = parser.parse_args()
     try:
         if args.vps_plan:
@@ -168,6 +216,16 @@ def main() -> int:
                 write_vps_plan(Path(args.plan_dir).resolve(), plan)
             print(json.dumps(plan, indent=2, ensure_ascii=False))
             return 0
+        if args.retention_plan:
+            if not args.current_link:
+                parser.error("--current-link is required with --retention-plan")
+            plan = retention_plan(args.release_root, args.current_link, args.keep_releases)
+            output = Path(args.output).resolve() if args.output else None
+            if output:
+                output.parent.mkdir(parents=True, exist_ok=True)
+                output.write_text(json.dumps(plan, indent=2) + "\n", encoding="utf-8")
+            print(json.dumps(plan, indent=2, ensure_ascii=False))
+            return 0
         result = preflight(Path(args.project).resolve(), args.target, args.environment)
         if args.output:
             Path(args.output).parent.mkdir(parents=True, exist_ok=True)

package/bundled-tools/clis/maggie_design.py

@@ -526,6 +526,18 @@ def in_place_job(project: Path, routes: list[str], force: bool = False) -> int:
             project / "src" / "app" / relative / "page.tsx",
         ]
         match = next((path for path in candidates if path.is_file()), None)
+        if not match:
+            # Dynamic catch-all routes are the source of truth for many page
+            # families; a concrete URL still needs to resolve to that route
+            # before an in-place design job can be created.
+            roots = [project / "src" / "pages", project / "src" / "app"]
+            catchalls = {"[...slug]", "[[...slug]]"}
+            for root in roots:
+                if not root.is_dir():
+                    continue
+                match = next((path for path in root.rglob("*") if path.is_file() and path.stem in catchalls), None)
+                if match:
+                    break
         if not match:
             raise ValueError(f"existing route required for in-place redesign: {route}")
         resolved_routes.append({"route": value, "source": str(match)})

package/bundled-tools/clis/maggie_localization.py

@@ -186,6 +186,12 @@ def plan_job(args: argparse.Namespace) -> int:
         "targetLanguage": args.target_lang,
         "targetLocale": args.locale,
         "operation": args.operation,
+        "generationContract": {
+            "mode": args.operation,
+            "preserveMeaning": args.operation in {"translate", "polish", "localise", "rebrand"},
+            "allowStructuralRewrite": args.operation in {"rewrite", "rebrand"},
+            "marketAdaptation": args.operation in {"localise", "rebrand"},
+        },
         "translationGroupId": identity.get("translationGroupId", f"tg-{content_id}"),
         "sourceRevision": args.source_revision or (source_artifact or {}).get("sourceRevision") or content.get("sourceRevision", "unknown"),
         "status": "draft",
@@ -218,6 +224,11 @@ def validate_job(path: Path, source_path: Path | None = None, render_path: Path
     if not valid_locale(job.get("targetLocale")) or parse_locale(job.get("targetLocale"))[0] != job.get("targetLanguage"):
         errors.append("targetLocale must be a supported tag matching targetLanguage")
     translation = job.get("translation", {})
+    generation = job.get("generationContract", {})
+    if generation.get("mode") and generation.get("mode") != job.get("operation"):
+        errors.append("generationContract mode must match operation")
+    if job.get("operation") == "rewrite" and not generation.get("allowStructuralRewrite"):
+        errors.append("rewrite requires structural rewrite permission")
     errors.extend(validate_translation({
         "contentId": job.get("contentId"), "lang": job.get("targetLanguage"),
         "locale": job.get("targetLocale"), "translationGroupId": job.get("translationGroupId", f"tg-{job.get('contentId')}"),

package/bundled-tools/clis/maggie_service_booking.py

@@ -793,9 +793,9 @@ def cmd_match_pages_review(args):
         out=project/".maggie"/"booking"/"page-matches.json"; out.parent.mkdir(parents=True,exist_ok=True); (project/"docs").mkdir(parents=True,exist_ok=True); payload={"matchedAt":NOW(),"requiresManualSelection":True,"candidateServices":report,"selected":0,"conflicts":conflicts}; out.write_text(json.dumps(payload,indent=2,ensure_ascii=False)+"\n",encoding="utf-8"); (project/"docs"/"service-page-matches.json").write_text(json.dumps(payload,indent=2,ensure_ascii=False)+"\n",encoding="utf-8"); print(json.dumps({"status":"conflict-review","pagesScanned":len(candidates),"servicesScanned":len(report),"selected":0,"conflicts":conflicts,"report":str(out)},indent=2)); return 1
     for service,path_value in selected:
         relation={"path":path_value,"role":"canonical","matchMethod":"manual-selection","confidence":1.0}; service["pages"]=[p for p in service.get("pages",[]) if p.get("path")!=path_value]+[relation]
-    candidate_paths={c["path"] for c in candidates}
-    for service in data.get("services",[]):
-        service["pages"]=[p for p in service.get("pages",[]) if p.get("role")!="supporting" or p.get("path") in candidate_paths]
+    # Reviewed selections must not erase existing supporting relations. They
+    # may have been imported from a route table or authored intentionally even
+    # when the current page scanner cannot see their source file.
     out=project/".maggie"/"booking"/"page-matches.json"; payload={"matchedAt":NOW(),"requiresManualSelection":True,"candidateServices":report,"selected":len(selected),"conflicts":[]}; out.parent.mkdir(parents=True,exist_ok=True); (project/"docs").mkdir(parents=True,exist_ok=True); out.write_text(json.dumps(payload,indent=2,ensure_ascii=False)+"\n",encoding="utf-8"); (project/"docs"/"service-page-matches.json").write_text(json.dumps(payload,indent=2,ensure_ascii=False)+"\n",encoding="utf-8"); save(project,data); print(json.dumps({"status":"review-required","pagesScanned":len(candidates),"servicesScanned":len(report),"selected":len(selected),"conflicts":[],"report":str(out)},indent=2)); return 0
 def cmd_run(args):
     project=root(args); job={"workflow":"maggie-service-booking","phase":"created","source":args.source,"provider":args.provider,"startedAt":NOW(),"history":[]}

package/bundled-tools/clis/site_audit.py

@@ -32,6 +32,7 @@ class PageParser(HTMLParser):
         self._jsonld = None
         self.images = []
         self.hreflang = []
+        self.robots_directives = []
 
     def handle_starttag(self, tag, attrs):
         data = dict(attrs)
@@ -39,6 +40,8 @@ class PageParser(HTMLParser):
             self.lang = data.get("lang", "")
         if tag == "meta" and data.get("name"):
             self.meta[data["name"].lower()] = data.get("content", "")
+            if data["name"].lower() == "robots":
+                self.robots_directives.append(data.get("content", "").lower())
         if tag == "meta" and data.get("property"):
             self.meta[data["property"].lower()] = data.get("content", "")
         if tag == "title":
@@ -86,6 +89,8 @@ def audit_page(url: str, html: str, status: int, content_type: str, expected_lan
     page = PageParser()
     page.feed(html)
     canonical = urljoin(url, page.canonical) if page.canonical else ""
+    robots = page.robots_directives
+    robots_tokens = [token.strip() for directive in robots for token in directive.split(",")]
     return {
         "url": url,
         "status": status,
@@ -105,6 +110,9 @@ def audit_page(url: str, html: str, status: int, content_type: str, expected_lan
         "image_count": len(page.images),
         "language": parse_locale(page.lang)[0],
         "hreflang": page.hreflang,
+        "robots": not robots or not any(token in {"noindex", "none", "nofollow"} for token in robots_tokens),
+        "robots_directives": robots,
+        "robots_conflict": len({token for token in robots_tokens if token in {"index", "noindex", "follow", "nofollow", "none"}} & {"index", "noindex"}) > 1 or len({token for token in robots_tokens if token in {"follow", "nofollow", "none"}} & {"follow", "nofollow"}) > 1,
     }
 
 
@@ -197,6 +205,9 @@ def main() -> int:
         checks["jsonld"] = {"ok": page.jsonld > 0 and all(item is not None for item in page.jsonld_values), "count": page.jsonld}
         checks["entity_jsonld"] = {"ok": any(isinstance(item, dict) and item.get("@type") and (item.get("url") or item.get("@id")) for item in page.jsonld_values), "count": page.jsonld}
         checks["crawlable_links"] = {"ok": page.anchors > 0, "count": page.anchors}
+        robots_tokens = [token.strip() for directive in page.robots_directives for token in directive.split(",")]
+        checks["robots_directive"] = {"ok": not page.robots_directives or not any(token in {"noindex", "none", "nofollow"} for token in robots_tokens), "directives": page.robots_directives}
+        checks["robots_conflict"] = {"ok": not (len({token for token in robots_tokens if token in {"index", "noindex"}}) > 1 or len({token for token in robots_tokens if token in {"follow", "nofollow"}}) > 1), "directives": page.robots_directives}
         if args.check_hreflang or args.check_translation_completeness:
             checks["hreflang"] = hreflang_check(base, page, expected_languages) if args.check_hreflang else {"ok": True, "links": page.hreflang}
             if args.check_translation_completeness and expected_languages:
@@ -233,7 +244,7 @@ def main() -> int:
                             page_checks["translation_completeness"] = {"ok": all(lang in {item["lang"] for item in parsed.hreflang} for lang in expected_languages), "expected": sorted(expected_languages)}
                     page_checks["passed"] = all(
                         page_checks[key]
-                        for key in ("ok", "title", "h1", "canonical", "description", "locale", "open_graph", "twitter_card", "jsonld", "entity_jsonld", "images")
+                        for key in ("ok", "title", "h1", "canonical", "description", "locale", "open_graph", "twitter_card", "jsonld", "entity_jsonld", "images", "robots", "robots_conflict")
                     ) and (not args.check_hreflang or page_checks["hreflang_check"]["ok"]) and (not args.check_translation_completeness or page_checks.get("translation_completeness", {}).get("ok", False))
                 except Exception as exc:
                     page_checks = {"url": page_url, "passed": False, "error": type(exc).__name__}

package/bundled-tools/runtime/maggie_sitemap.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import hashlib
+import json
 import re
 from datetime import datetime, timezone
 from html import escape
@@ -27,10 +28,18 @@ def parse_routes(text: str) -> list[dict[str, str]]:
             continue
         parts = line.split("\t")
         if len(parts) < 2:
-            raise ValueError("route lines must be type<TAB>absolute-url<TAB>optional-lastmod")
+            raise ValueError("route lines must be type<TAB>absolute-url<TAB>optional-lastmod<TAB>optional-alternates-json")
         item = {"type": parts[0].strip(), "url": parts[1].strip()}
         if len(parts) > 2 and parts[2].strip():
             item["lastmod"] = parts[2].strip()
+        if len(parts) > 3 and parts[3].strip():
+            try:
+                alternates = json.loads(parts[3])
+            except json.JSONDecodeError as exc:
+                raise ValueError("route alternates must be valid JSON") from exc
+            if not isinstance(alternates, dict):
+                raise ValueError("route alternates must be a JSON object")
+            item["alternates"] = alternates
         routes.append(item)
     return routes
 
@@ -63,8 +72,9 @@ def xml_file(urls: list[dict[str, str]]) -> str:
     rows = []
     for item in urls:
         lastmod = f"<lastmod>{escape(item['lastmod'])}</lastmod>" if item.get("lastmod") else ""
-        rows.append(f"<url><loc>{escape(item['url'])}</loc>{lastmod}</url>")
-    return '<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' + "".join(rows) + "</urlset>\n"
+        alternate_xml = "".join(f'<xhtml:link rel="alternate" hreflang="{escape(str(lang))}" href="{escape(str(url))}" />' for lang, url in sorted((item.get("alternates") or {}).items()))
+        rows.append(f"<url><loc>{escape(item['url'])}</loc>{lastmod}{alternate_xml}</url>")
+    return '<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml">' + "".join(rows) + "</urlset>\n"
 
 
 def build_plan(routes: list[dict[str, str]], origin: str, content_types: set[str], chunk_target: int = DEFAULT_CHUNK_TARGET, previous: dict | None = None) -> dict:
@@ -112,6 +122,9 @@ def validate_plan_data(plan: dict) -> dict:
                 locs = [element.text or "" for element in root.iter() if element.tag.endswith("loc")]
                 if any(not absolute_url(value, origin) for value in locs):
                     errors.append(f"chunk contains a relative or off-origin loc: {chunk.get('filename')}")
+                for link in root.iter():
+                    if link.tag.endswith("link") and link.get("rel") == "alternate" and not absolute_url(link.get("href", ""), origin):
+                        errors.append(f"chunk contains a relative or off-origin alternate: {chunk.get('filename')}")
             except ElementTree.ParseError:
                 errors.append(f"chunk is not valid XML: {chunk.get('filename')}")
     index = plan.get("index", {})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.6.7",
+  "version": "0.6.9",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",