@topy-ai/maggie 0.7.2 → 0.7.4

package/README.md

@@ -191,8 +191,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.2 update --project . --force
-npx @topy-ai/maggie@0.7.2 cleanup --project .
+npx @topy-ai/maggie@0.7.4 update --project . --force
+npx @topy-ai/maggie@0.7.4 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -202,14 +202,15 @@ as a command-line argument:
 node scripts/publish-npm.mjs --maggie-env-file ../.env
 ```
 
-The 0.7.2 workflow adds the installable MaggieDash admin distribution and
+The 0.7.4 workflow adds the installable MaggieDash admin distribution and
 audited CMS operations (`cms revisions`,
-`trash`, `restore`, `schedule`, `duplicate`, `redirect`, and signed
-`preview`), import-authoritative service matching, shared translation indexes,
-sanitized seed manifests, lockfile/analytics traffic checks, semantic sitemap
-validation, locale-aware `llms.txt`/`sitemap.md`/`insights.md` generation,
-explicit integration states, and deployment Origin/infrastructure/data
-rollback gates.
+`trash`, `restore`, `schedule`, `publish-due`, `duplicate`, `redirect`, and
+signed `preview`). It also adds a read-only MaggieDash `--diff`/`--dry-run`
+migration inventory, body-only dashboard prop validation, dialog accessibility
+contract checks, 404-only redirect policy, trash/scheduler/preview invariants,
+and a shared first-party traffic filter for every measurement channel. The
+release retains the existing service matching, localization, seed-manifest,
+lockfile/analytics, sitemap, deployment and rollback workflows.
 
 ## MaggieDash lifecycle
 
@@ -231,6 +232,17 @@ for local development or a configured private Git URL. The host project keeps
 ownership of routes, email/password auth, database, provider credentials, and
 the `/api/maggie/*` adapter.
 
+Compare an existing dashboard before replacing it:
+
+```bash
+maggie dash install --project . --diff \
+  --existing-dir src/plugins/maggie-studio/src
+maggie dash install --project . --dry-run
+```
+
+These commands do not write files or installation state. Review the report and
+map host-owned files before using `--force`.
+
 Content remains draft-first and external writes remain explicit. Use the
 project-local memory workflow for confirmed preferences and reusable lessons;
 feedback drafts are never promoted to active memory automatically.

package/bundled-contracts/maggiedash/README.md

@@ -14,6 +14,10 @@ frontend framework.
   dry-run, backup, checksum, cutover, and rollback evidence;
 - [`storage-model.md`](storage-model.md): SQLite/PostgreSQL table ownership and
   adapter rules.
+- [`redirect-policy-v1.json`](redirect-policy-v1.json): 404-only lookup and
+  self/chain safety for canonical route redirects;
+- [`telemetry-policy-v1.json`](telemetry-policy-v1.json): first-party/toolchain
+  traffic exclusion for every measurement channel.
 
 MaggieDash owns these contracts. Provider adapters may add namespaced metadata,
 but they may not change the required identity, status, provenance, or approval
@@ -32,3 +36,15 @@ published → archived
 
 No import, AI generation, rewrite, or adapter sync may publish content without
 an approval record and an auditable actor/correlation ID.
+
+## CMS invariants
+
+- `trashed` is a status. Public readers exclude it; trash is reversible.
+- A no-op save creates no revision, and the first update of an imported row
+  snapshots the existing state before replacing it.
+- Scheduled content with a past timestamp is published on the next scheduler
+  tick. A trashed row is never selected by the due query.
+- Preview responses are real preview routes protected by HMAC tokens and
+  advertise `noindex`, `X-Robots-Tag: noindex`, and `Cache-Control: no-store`.
+- Redirect lookup happens after the route has returned 404. Self-redirects and
+  redirect chains are rejected at write time.

package/bundled-contracts/maggiedash/redirect-policy-v1.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/redirect-policy-v1.schema.json",
+  "title": "MaggieDash redirect policy v1",
+  "type": "object",
+  "required": ["schemaVersion", "lookupAfterStatus", "rejectSelf", "rejectChains"],
+  "properties": {
+    "schemaVersion": {"const": "maggiedash-redirect-policy.v1"},
+    "lookupAfterStatus": {"const": 404},
+    "rejectSelf": {"const": true},
+    "rejectChains": {"const": true},
+    "allowedStatusCodes": {"type": "array", "items": {"enum": [301, 302, 307, 308]}}
+  },
+  "additionalProperties": false
+}

package/bundled-contracts/maggiedash/telemetry-policy-v1.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggiedash.noblox.app/contracts/telemetry-policy-v1.schema.json",
+  "title": "MaggieDash telemetry policy v1",
+  "type": "object",
+  "required": ["schemaVersion", "filterBeforeMeasurement", "channels"],
+  "properties": {
+    "schemaVersion": {"const": "maggiedash-telemetry-policy.v1"},
+    "filterBeforeMeasurement": {"const": true},
+    "channels": {
+      "type": "array",
+      "items": {"enum": ["page_view", "not_found", "redirect_hit", "booking_click", "analytics", "audit"]},
+      "minItems": 1
+    },
+    "identityInference": {"const": "forbidden"}
+  },
+  "additionalProperties": false
+}

package/bundled-references/maggiedash-telemetry-contract.md

@@ -0,0 +1,12 @@
+# MaggieDash telemetry contract
+
+Every measurement path must call the shared first-party traffic filter before
+incrementing a counter or writing a measurement event. This includes page
+views, 404/not-found rows, redirect hits, booking clicks, analytics events and
+operational audit counters. Filtering only page views leaves synthetic sweeps
+in the other totals.
+
+Use `should_record_measurement(event)` from
+`tools/runtime/analytics_traffic.py`. The filter accepts explicit Maggie/test
+markers and known toolchain user agents; it never guesses identity from IP
+addresses or private user fields.

package/bundled-skills/maggie-dash/SKILL.md

@@ -25,6 +25,22 @@ explicitly supplied, and records the resolved revision in
 CLI argument. For local development or a pinned checkout, use
 `--source /path/to/MaggieDash` or `--source URL --ref REF`.
 
+Before replacing an existing hand-written dashboard, create a read-only
+migration report. It compares the first-party manifest with the existing
+workspace and labels additions, unchanged files, updates that would be
+preserved, and unmanaged files:
+
+```bash
+maggie dash install --project . --diff \
+  --existing-dir src/plugins/maggie-studio/src
+maggie dash install --project . --dry-run
+```
+
+These modes do not require `--confirm` and do not write dashboard files or
+`.maggie/dash-install.json`. Review the report and explicitly map or back up
+hand-written files before using `--force`; an idempotent installer is not a
+schema migration.
+
 The installed dashboard owns the React workspace UI. The host project still
 owns the framework route, email/password session middleware, database, media
 storage, provider credentials, and `/api/maggie/*` adapter endpoints. Read the
@@ -105,6 +121,8 @@ maggie dash cms trash --project . --project-id local-project --document-id <id>
 maggie dash cms restore --project . --project-id local-project --document-id <id> --reason "restore" --confirm
 maggie dash cms schedule --project . --project-id local-project --document-id <id> \
   --publish-at 2026-09-20T10:00:00Z --reason "approved release" --confirm
+maggie dash cms publish-due --project . --project-id local-project \
+  --reason "scheduled publish tick" --confirm
 maggie dash cms duplicate --project . --project-id local-project --document-id <id> \
   --new-id <new-id> --new-slug <new-slug> --reason "create draft" --confirm
 maggie dash cms redirect --project . --project-id local-project --from-path /old --to-path /new \
@@ -114,6 +132,13 @@ maggie dash cms preview --project . --project-id local-project --document-id <id
 ```
 
 Content writes create immutable revision snapshots. Trash is reversible and
-does not destroy the document. Scheduling is accepted only for approved
-content and requires a timezone. Preview tokens are short-lived HMAC-signed
-tokens; never place the secret in source control or generated reports.
+does not destroy the document; public readers must filter `status=trashed`.
+Scheduling is accepted only for approved content and requires a timezone; a
+past timestamp is published on the next scheduler tick, while trashed rows
+are never eligible. A no-op save creates no revision, and the first update of
+an imported row snapshots its prior state. Redirects are consulted only after
+the route returns 404 and self/chain redirects are rejected. Preview tokens
+are short-lived HMAC-signed tokens; preview responses must use a real preview
+URL with `noindex`, `X-Robots-Tag: noindex`, and `Cache-Control: no-store`.
+Never place the secret in source control or generated reports. See the
+provider-neutral [MaggieDash contract set](../../contracts/maggiedash/README.md).

package/bundled-skills/maggie-ops/SKILL.md

@@ -220,5 +220,9 @@ The seed manifest must be opt-in, sanitized, and contain non-empty fixtures;
 an empty dev database is not evidence that an operational check passed.
 Known Maggie/toolchain traffic can be measured without polluting first-party
 analytics using `maggie analytics traffic-audit --events events.json`. The
-classifier excludes only explicit tool/test markers and never infers identity
-from IP or private fields.
+classifier must run before every measurement channel, including page views,
+404/not-found rows, redirect hits, booking clicks and audit counters. The
+shared contract is in
+[references/maggiedash-telemetry-contract.md](../../references/maggiedash-telemetry-contract.md);
+it excludes only explicit tool/test markers and never infers identity from IP
+or private fields.

package/bundled-templates/maggiedash/dashboard-ui-contract.json

@@ -13,19 +13,20 @@
   "components": [
     {
       "name": "WorkspaceBar",
-      "props": ["workspaceName", "activeSection", "actions", "children"],
+      "props": ["tabs", "active", "onSelect", "lead", "actions"],
       "forbiddenProps": []
     },
     {
       "name": "WorkspaceCard",
-      "props": ["title", "children"],
+      "props": ["children", "className"],
       "forbiddenProps": []
-    },
-    {
-      "name": "ContentTabs",
-      "props": ["tabs", "active", "actions", "children"],
-      "forbiddenProps": ["title", "description"]
     }
   ],
+  "dialogs": {
+    "primitive": "Modal",
+    "overlayPrimitive": "Overlay",
+    "forbiddenSourcePatterns": ["window.confirm(", "window.prompt("],
+    "requiredLiterals": ["role=\"dialog\"", "aria-modal", "Escape", "opener.current"]
+  },
   "accessibility": ["active tab exposes aria-selected", "actions have accessible names", "workspace navigation has a landmark"]
 }

package/bundled-tools/clis/maggie_dash.py

@@ -77,12 +77,68 @@ def copy_dashboard_tree(source: Path, target: Path, force: bool) -> tuple[list[s
     return installed, preserved
 
 
+def manifest_file_pairs(source: Path, manifest: dict[str, object], target: Path) -> list[tuple[Path, Path, Path]]:
+    """Return source, install-target, and manifest-relative file paths."""
+    pairs: list[tuple[Path, Path, Path]] = []
+    for item in manifest.get("files", []):
+        relative = Path(str(item))
+        source_item = source / relative
+        if source_item.is_file():
+            relative_target = Path(*relative.parts[1:]) if relative.parts and relative.parts[0] == "admin" else relative
+            pairs.append((source_item, target / relative_target, relative))
+            continue
+        for path in sorted(source_item.rglob("*")):
+            if not path.is_file():
+                continue
+            child = path.relative_to(source_item)
+            relative_target = Path(*relative.parts[1:]) / child if relative.parts and relative.parts[0] == "admin" else relative / child
+            pairs.append((path, target / relative_target, relative / child))
+    return pairs
+
+
+def command_install_diff(source: Path, manifest: dict[str, object], target: Path, compare_dir: Path | None, force: bool) -> dict[str, object]:
+    pairs = manifest_file_pairs(source, manifest, target)
+    files: list[dict[str, str]] = []
+    source_relative = {relative for _, _, relative in pairs}
+    for source_file, destination, relative in pairs:
+        if compare_dir:
+            compare_relative = Path(*relative.parts[2:]) if relative.parts[:2] == ("admin", "src") else (Path(*relative.parts[1:]) if relative.parts and relative.parts[0] == "admin" else relative)
+            compare_file = compare_dir / compare_relative
+        else:
+            compare_file = destination
+        if not compare_file.exists():
+            action = "add"
+        elif compare_file.read_bytes() == source_file.read_bytes():
+            action = "unchanged"
+        else:
+            action = "update" if force else "preserve"
+        files.append({"path": str(relative), "action": action, "comparePath": str(compare_file)})
+    if compare_dir and compare_dir.exists():
+        for existing in sorted(compare_dir.rglob("*")):
+            if not existing.is_file():
+                continue
+            relative = existing.relative_to(compare_dir)
+            manifest_relative = Path("admin", "src", *relative.parts)
+            if manifest_relative not in source_relative:
+                files.append({"path": str(manifest_relative), "action": "unmanaged-existing", "comparePath": str(existing)})
+    summary: dict[str, int] = {}
+    for item in files:
+        summary[item["action"]] = summary.get(item["action"], 0) + 1
+    return {"status": "dry-run", "version": manifest.get("version"), "target": str(target), "compareDir": str(compare_dir) if compare_dir else None, "summary": summary, "files": files}
+
+
 def command_install(args: argparse.Namespace) -> int:
-    require_confirm(args)
+    if not args.dry_run and not args.diff:
+        require_confirm(args)
     root = project_root(args)
     source_value = args.source or os.environ.get("MAGGIE_DASH_SOURCE") or DEFAULT_DASH_SOURCE
     ref = args.ref
-    target = root / args.target
+    target_relative = Path(args.target)
+    if target_relative.is_absolute() or ".." in target_relative.parts:
+        raise RuntimeError("MaggieDash target must be a relative path inside the project")
+    target = (root / target_relative).resolve()
+    if root not in target.parents and target != root:
+        raise RuntimeError("MaggieDash target must remain inside the project")
     temporary: tempfile.TemporaryDirectory[str] | None = None
     source = Path(source_value).expanduser().resolve() if not source_value.startswith(("https://", "http://", "git@")) else None
     try:
@@ -107,6 +163,15 @@ def command_install(args: argparse.Namespace) -> int:
             raise RuntimeError("unsupported MaggieDash distribution schema")
         if manifest.get("target") != "_maggie/admin" and args.target == "_maggie/admin":
             raise RuntimeError("MaggieDash manifest target is not ./_maggie/admin")
+        compare_dir = None
+        if args.existing_dir:
+            compare_dir = Path(args.existing_dir).expanduser()
+            if not compare_dir.is_absolute():
+                compare_dir = root / compare_dir
+            compare_dir = compare_dir.resolve()
+        if args.dry_run or args.diff:
+            emit(command_install_diff(source, manifest, target, compare_dir, args.force))
+            return 0
         installed: list[str] = []
         preserved: list[str] = []
         for item in manifest.get("files", []):
@@ -223,6 +288,8 @@ def command_cms(args: argparse.Namespace) -> int:
             result = store.restore(args.project_id, args.document_id, args.actor, args.reason)
         elif args.cms_command == "schedule":
             result = store.schedule_publish(args.project_id, args.document_id, args.publish_at, args.actor, args.reason)
+        elif args.cms_command == "publish-due":
+            result = store.publish_due(args.project_id, args.now, args.actor, args.reason)
         elif args.cms_command == "duplicate":
             result = store.duplicate(args.project_id, args.document_id, args.new_id, args.new_slug, args.actor, args.reason)
         elif args.cms_command == "redirect":
@@ -294,6 +361,9 @@ def parser() -> argparse.ArgumentParser:
     install.add_argument("--ref", default="main", help="Git ref when installing from a remote source")
     install.add_argument("--target", default="_maggie/admin", help="installation target relative to the project")
     install.add_argument("--force", action="store_true", help="replace existing dashboard files")
+    install.add_argument("--dry-run", action="store_true", help="show the install plan without writing files")
+    install.add_argument("--diff", action="store_true", help="show the install plan and compare with an existing workspace")
+    install.add_argument("--existing-dir", help="existing dashboard source directory to compare during --diff")
     install.add_argument("--confirm", action="store_true")
     install.set_defaults(func=command_install)
     status = sub.add_parser("status", help="inspect project and documents")
@@ -321,6 +391,8 @@ def parser() -> argparse.ArgumentParser:
         command.add_argument("--document-id", required=True); command.add_argument("--actor", default="cli"); command.add_argument("--reason", default="CMS operation"); command.add_argument("--confirm", action="store_true")
     schedule = cms_sub.add_parser("schedule")
     schedule.add_argument("--project", default="."); schedule.add_argument("--project-id", default="local-project"); schedule.add_argument("--document-id", required=True); schedule.add_argument("--publish-at", required=True); schedule.add_argument("--actor", default="cli"); schedule.add_argument("--reason", required=True); schedule.add_argument("--confirm", action="store_true")
+    publish_due = cms_sub.add_parser("publish-due", help="publish approved scheduled content whose time has arrived")
+    publish_due.add_argument("--project", default="."); publish_due.add_argument("--project-id", default="local-project"); publish_due.add_argument("--now"); publish_due.add_argument("--actor", default="scheduler"); publish_due.add_argument("--reason", default="scheduled publish tick"); publish_due.add_argument("--confirm", action="store_true")
     duplicate = cms_sub.add_parser("duplicate")
     duplicate.add_argument("--project", default="."); duplicate.add_argument("--project-id", default="local-project"); duplicate.add_argument("--document-id", required=True); duplicate.add_argument("--new-id", required=True); duplicate.add_argument("--new-slug", required=True); duplicate.add_argument("--actor", default="cli"); duplicate.add_argument("--reason", required=True); duplicate.add_argument("--confirm", action="store_true")
     redirect = cms_sub.add_parser("redirect")

package/bundled-tools/runtime/analytics_traffic.py

@@ -17,13 +17,18 @@ def is_tool_traffic(event: dict) -> bool:
     return bool(TOOL_USER_AGENT.search(str(event.get("userAgent") or "")))
 
 
+def should_record_measurement(event: dict) -> bool:
+    """Apply the same exclusion before every counter or event logger."""
+    return not is_tool_traffic(event)
+
+
 def audit_events(events: Iterable[dict]) -> dict:
     totals = Counter()
     excluded = Counter()
     included = 0
     for event in events:
         totals[str(event.get("event") or "unknown")] += 1
-        if is_tool_traffic(event):
+        if not should_record_measurement(event):
             excluded[str(event.get("event") or "unknown")] += 1
         else:
             included += 1

package/bundled-tools/runtime/maggie_dash_store.py

@@ -14,7 +14,7 @@ from pathlib import Path
 from typing import Any
 
 
-STATUSES = ("draft", "review", "approved", "scheduled", "published", "archived")
+STATUSES = ("draft", "review", "approved", "scheduled", "published", "archived", "trashed")
 TRANSITIONS = {
     "draft": {"review"},
     "review": {"approved", "draft"},
@@ -22,6 +22,7 @@ TRANSITIONS = {
     "scheduled": {"published", "draft"},
     "published": {"archived"},
     "archived": set(),
+    "trashed": set(),
 }
 
 
@@ -120,8 +121,15 @@ class MaggieDashStore:
         status = document.get("status", "draft")
         if status not in STATUSES:
             raise ValueError(f"invalid document status: {status}")
-        stable = {key: value for key, value in document.items() if key not in {"provenance", "checksum"}}
-        document_checksum = document.get("provenance", {}).get("checksum") or checksum(stable)
+        stable = {
+            "id": document["id"], "kind": document["kind"], "title": document["title"],
+            "slug": document["slug"], "locale": document["locale"], "status": status,
+            "excerpt": document.get("excerpt", ""), "content": document["content"],
+            "canonicalUrl": document.get("canonicalUrl"), "publishAt": document.get("publishAt"),
+        }
+        # Provenance is evidence about the source, not the content identity. A
+        # provider checksum must never turn a no-op save into a new revision.
+        document_checksum = checksum(stable)
         existing = self.connection.execute("SELECT * FROM maggiedash_documents WHERE id=?", (document["id"],)).fetchone()
         if existing and existing["status"] != status:
             raise ValueError("status changes must use transition()")
@@ -183,10 +191,10 @@ class MaggieDashStore:
         row = self.connection.execute("SELECT status, trashed_at FROM maggiedash_documents WHERE project_id=? AND id=?", (project_id, document_id)).fetchone()
         if not row:
             raise ValueError("document not found")
-        if row["trashed_at"]:
+        if row["trashed_at"] or row["status"] == "trashed":
             return self.get_document(project_id, document_id) or {}
         timestamp = now()
-        self.connection.execute("UPDATE maggiedash_documents SET trashed_at=?, trashed_from_status=?, updated_at=? WHERE id=?", (timestamp, row["status"], timestamp, document_id))
+        self.connection.execute("UPDATE maggiedash_documents SET status='trashed', trashed_at=?, trashed_from_status=?, updated_at=? WHERE id=?", (timestamp, row["status"], timestamp, document_id))
         self._audit(project_id, "document.trashed", "document", document_id, actor_id, reason)
         self.connection.commit()
         return self.get_document(project_id, document_id) or {}
@@ -195,15 +203,38 @@ class MaggieDashStore:
         row = self.connection.execute("SELECT trashed_at, trashed_from_status FROM maggiedash_documents WHERE project_id=? AND id=?", (project_id, document_id)).fetchone()
         if not row:
             raise ValueError("document not found")
-        if not row["trashed_at"]:
+        if not row["trashed_at"] and row["trashed_from_status"] is None:
             return self.get_document(project_id, document_id) or {}
         status = row["trashed_from_status"] if row["trashed_from_status"] in STATUSES else "draft"
+        if status == "trashed":
+            status = "draft"
         timestamp = now()
         self.connection.execute("UPDATE maggiedash_documents SET status=?, trashed_at=NULL, trashed_from_status=NULL, updated_at=? WHERE id=?", (status, timestamp, document_id))
         self._audit(project_id, "document.restored", "document", document_id, actor_id, reason)
         self.connection.commit()
         return self.get_document(project_id, document_id) or {}
 
+    def publish_due(self, project_id: str, now_value: str | None = None, actor_id: str = "scheduler", reason: str = "scheduled publish tick") -> list[dict[str, Any]]:
+        """Publish scheduled documents whose timestamp has arrived.
+
+        The status predicate is intentional: a trashed document may retain an
+        old publish timestamp, but it is never eligible for promotion.
+        """
+        current = datetime.fromisoformat((now_value or now()).replace("Z", "+00:00"))
+        rows = self.connection.execute(
+            "SELECT id, publish_at FROM maggiedash_documents WHERE project_id=? AND status='scheduled' AND publish_at IS NOT NULL ORDER BY id",
+            (project_id,),
+        ).fetchall()
+        published: list[dict[str, Any]] = []
+        for row in rows:
+            try:
+                scheduled = datetime.fromisoformat(str(row["publish_at"]).replace("Z", "+00:00"))
+            except ValueError:
+                continue
+            if scheduled.tzinfo is not None and scheduled <= current:
+                published.append(self.transition(project_id, row["id"], "published", actor_id, reason))
+        return published
+
     def schedule_publish(self, project_id: str, document_id: str, publish_at: str, actor_id: str, reason: str) -> dict[str, Any]:
         try:
             target = datetime.fromisoformat(publish_at.replace("Z", "+00:00"))
@@ -238,10 +269,17 @@ class MaggieDashStore:
         return result
 
     def add_redirect(self, project_id: str, from_path: str, to_path: str, actor_id: str, reason: str, status_code: int = 301) -> dict[str, Any]:
-        if not from_path.startswith("/") or not to_path.startswith("/") or from_path == to_path:
+        if not from_path.startswith("/") or not to_path.startswith("/") or self._normalise_path(from_path) == self._normalise_path(to_path):
             raise ValueError("redirect paths must be distinct absolute paths")
         if status_code not in {301, 302, 307, 308}:
             raise ValueError("status_code must be 301, 302, 307 or 308")
+        destination = self._normalise_path(to_path)
+        chain = self.connection.execute(
+            "SELECT 1 FROM maggiedash_redirects WHERE project_id=? AND ((from_path=? OR rtrim(from_path, '/')=?) OR (to_path=? OR rtrim(to_path, '/')=?)) LIMIT 1",
+            (project_id, destination, destination, from_path, self._normalise_path(from_path)),
+        ).fetchone()
+        if chain:
+            raise ValueError("redirect destination must not already redirect")
         record = (str(uuid.uuid4()), project_id, from_path, to_path, status_code, reason, actor_id, now())
         self.connection.execute("INSERT INTO maggiedash_redirects VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(project_id,from_path) DO UPDATE SET to_path=excluded.to_path, status_code=excluded.status_code, reason=excluded.reason, actor_id=excluded.actor_id, created_at=excluded.created_at", record)
         self._audit(project_id, "redirect.upserted", "redirect", from_path, actor_id, reason)
@@ -249,6 +287,22 @@ class MaggieDashStore:
         row = self.connection.execute("SELECT * FROM maggiedash_redirects WHERE project_id=? AND from_path=?", (project_id, from_path)).fetchone()
         return dict(row)
 
+    @staticmethod
+    def _normalise_path(path: str) -> str:
+        path = path.split("?", 1)[0].split("#", 1)[0]
+        return path.rstrip("/") or "/"
+
+    def resolve_redirect(self, project_id: str, path: str, response_status: int) -> dict[str, Any] | None:
+        """Consult redirects only after the route has already returned 404."""
+        if response_status != 404:
+            return None
+        normalised = self._normalise_path(path)
+        row = self.connection.execute(
+            "SELECT * FROM maggiedash_redirects WHERE project_id=? AND (from_path=? OR rtrim(from_path, '/')=?) ORDER BY CASE WHEN from_path=? THEN 0 ELSE 1 END LIMIT 1",
+            (project_id, path, normalised, path),
+        ).fetchone()
+        return dict(row) if row else None
+
     def issue_preview(self, project_id: str, document_id: str, secret: str, ttl_seconds: int = 900) -> dict[str, Any]:
         if not secret:
             raise ValueError("preview secret is required")
@@ -258,7 +312,15 @@ class MaggieDashStore:
         payload = f"{project_id}:{document_id}:{expires}".encode()
         encoded = base64.urlsafe_b64encode(payload).decode().rstrip("=")
         signature = hmac.new(secret.encode(), encoded.encode(), hashlib.sha256).hexdigest()
-        return {"token": f"{encoded}.{signature}", "expiresAt": datetime.fromtimestamp(expires, timezone.utc).isoformat().replace("+00:00", "Z")}
+        return {
+            "token": f"{encoded}.{signature}",
+            "expiresAt": datetime.fromtimestamp(expires, timezone.utc).isoformat().replace("+00:00", "Z"),
+            "headers": {
+                "Cache-Control": "no-store",
+                "X-Robots-Tag": "noindex, nofollow",
+                "metaRobots": "noindex, nofollow",
+            },
+        }
 
     @staticmethod
     def verify_preview(token: str, secret: str, project_id: str, document_id: str) -> bool:

package/bundled-tools/runtime/maggie_dash_ui.py

@@ -15,6 +15,23 @@ def _component_source(name: str, source: str) -> str:
     return match.group(0) if match else ""
 
 
+def _render_body(component_source: str) -> str:
+    """Return the component implementation, excluding its props signature.
+
+    A declaration and its TypeScript type are evidence that a prop exists, not
+    evidence that the rendered UI uses it. Counting only the implementation
+    prevents a dead prop from passing because it appears twice in the signature.
+    """
+    # Typed destructured parameters contain their own `{...}` block. The
+    # function body is the last opening brace before the first return.
+    return_position = component_source.find("return")
+    opening = component_source.rfind("{", 0, return_position if return_position != -1 else len(component_source))
+    if opening == -1:
+        arrow = component_source.find("=>")
+        opening = component_source.find("{", arrow) if arrow != -1 else -1
+    return component_source[opening + 1:] if opening != -1 else ""
+
+
 def validate(contract: object, sources: Iterable[str] = ()) -> dict:
     errors: list[str] = []
     if not isinstance(contract, dict):
@@ -44,12 +61,29 @@ def validate(contract: object, sources: Iterable[str] = ()) -> dict:
         forbidden = [str(prop) for prop in component.get("forbiddenProps", [])]
         if component_source:
             signature = component_source.split("=>", 1)[0] if "=>" in component_source else component_source[:500]
+            body = _render_body(component_source)
             for prop in props:
-                if len(re.findall(rf"\b{re.escape(prop)}\b", component_source)) < 2:
+                if len(re.findall(rf"\b{re.escape(prop)}\b", body)) < 1:
                     errors.append(f"{name}.{prop} is declared but not evidenced in rendered output")
             for prop in forbidden:
                 if re.search(rf"\b{re.escape(prop)}\b", signature):
                     errors.append(f"{name} declares forbidden dead prop: {prop}")
+    dialogs = contract.get("dialogs")
+    if isinstance(dialogs, dict) and source:
+        for pattern in dialogs.get("forbiddenSourcePatterns", []):
+            pattern = str(pattern)
+            if pattern in source:
+                errors.append(f"dialog contract forbids source pattern: {pattern}")
+        required = [str(item) for item in dialogs.get("requiredLiterals", [])]
+        for key in ("primitive", "overlayPrimitive"):
+            name = str(dialogs.get(key) or "")
+            component_source = _component_source(name, source) if name else ""
+            if not component_source:
+                errors.append(f"dialog source is missing: {name}")
+                continue
+            for literal in required:
+                if literal not in component_source:
+                    errors.append(f"{name} is missing dialog requirement: {literal}")
     return {"schemaVersion": SCHEMA, "passed": not errors, "errors": errors, "components": [item.get("name") for item in components if isinstance(item, dict)]}
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",

package/references/maggiedash-telemetry-contract.md

@@ -0,0 +1,12 @@
+# MaggieDash telemetry contract
+
+Every measurement path must call the shared first-party traffic filter before
+incrementing a counter or writing a measurement event. This includes page
+views, 404/not-found rows, redirect hits, booking clicks, analytics events and
+operational audit counters. Filtering only page views leaves synthetic sweeps
+in the other totals.
+
+Use `should_record_measurement(event)` from
+`tools/runtime/analytics_traffic.py`. The filter accepts explicit Maggie/test
+markers and known toolchain user agents; it never guesses identity from IP
+addresses or private user fields.