@topy-ai/maggie 0.7.40 → 0.7.42

package/bundled-tools/clis/maggie_contracts.py

@@ -237,6 +237,105 @@ def validate_capabilities(args: argparse.Namespace) -> int:
     return emit_and_exit(result("maggie-host-capabilities.v1", errors, enabled=sum(1 for item in endpoints if isinstance(item, dict) and item.get("enabled") is True), endpointCount=len(endpoints)), Path(args.output) if args.output else None)
 
 
+def validate_style_editing(args: argparse.Namespace) -> int:
+    """Validate a closed, host-rendered style editing contract."""
+    manifest = read_json(Path(args.manifest))
+    errors: list[str] = []
+    if manifest.get("schemaVersion") != "maggie-style-editing.v1":
+        errors.append("manifest schemaVersion must be maggie-style-editing.v1")
+    properties = manifest.get("properties")
+    if not isinstance(properties, list) or not properties:
+        errors.append("properties must be a non-empty array")
+        properties = []
+    allowed: set[str] = set()
+    patterns: dict[str, str] = {}
+    dangerous = re.compile(r"(?:;|url\s*\(|expression\s*\(|<|>|javascript:)", re.I)
+    for item in properties:
+        if not isinstance(item, dict):
+            errors.append("each style property must be an object")
+            continue
+        name = str(item.get("name") or "")
+        pattern = str(item.get("pattern") or "")
+        if not re.fullmatch(r"[A-Za-z][A-Za-z0-9-]*", name):
+            errors.append(f"invalid style property name: {name or 'unknown'}")
+        if name in allowed:
+            errors.append(f"duplicate style property: {name}")
+        allowed.add(name)
+        if not pattern:
+            errors.append(f"style property {name or 'unknown'} needs a value pattern")
+        else:
+            try:
+                re.compile(pattern)
+                patterns[name] = pattern
+            except re.error:
+                errors.append(f"style property {name or 'unknown'} has an invalid value pattern")
+    for template in manifest.get("templates") or []:
+        if not isinstance(template, dict) or not str(template.get("id") or ""):
+            errors.append("each style template needs an id")
+            continue
+        for name, value in (template.get("styles") or {}).items():
+            if name not in allowed:
+                errors.append(f"style template {template['id']} uses undeclared property: {name}")
+                continue
+            if not isinstance(value, str) or dangerous.search(value) or not re.fullmatch(patterns[name], value):
+                errors.append(f"style template {template['id']} has an unsafe value for {name}")
+    return emit_and_exit(result("maggie-style-editing.v1", errors, properties=sorted(allowed), templates=len(manifest.get("templates") or [])), Path(args.output) if args.output else None)
+
+
+def validate_content_overrides(args: argparse.Namespace) -> int:
+    manifest = read_json(Path(args.manifest))
+    errors: list[str] = []
+    if manifest.get("schemaVersion") != "maggie-content-overrides.v1":
+        errors.append("manifest schemaVersion must be maggie-content-overrides.v1")
+    expected = {
+        "readAtRequestTime": True,
+        "sourceLiteralIsFallback": True,
+        "writesCreateRevision": True,
+        "conflictRequiresSourceRevision": True,
+        "orphanPolicy": "report-and-never-publish",
+    }
+    for key, value in expected.items():
+        if manifest.get(key) != value:
+            errors.append(f"{key} must be {value!r}")
+    if not isinstance(manifest.get("protectedFields"), list) or not manifest.get("protectedFields"):
+        errors.append("protectedFields must list factual fields that cannot be overridden")
+    return emit_and_exit(result("maggie-content-overrides.v1", errors, protectedFields=manifest.get("protectedFields", [])), Path(args.output) if args.output else None)
+
+
+def validate_session_contract(args: argparse.Namespace) -> int:
+    manifest = read_json(Path(args.manifest))
+    errors: list[str] = []
+    if manifest.get("schemaVersion") != "maggie-browser-session.v1":
+        errors.append("manifest schemaVersion must be maggie-browser-session.v1")
+    if manifest.get("mintingBoundary") != "host-adapter":
+        errors.append("mintingBoundary must be host-adapter")
+    if manifest.get("passwordHandling") != "never-exposed":
+        errors.append("passwordHandling must be never-exposed")
+    ttl = manifest.get("ttlMinutes")
+    if not isinstance(ttl, int) or not 1 <= ttl <= 240:
+        errors.append("ttlMinutes must be between 1 and 240")
+    for key in ("mintRoute", "revokeRoute"):
+        if not str(manifest.get(key) or "").startswith("/"):
+            errors.append(f"{key} must be a relative host route")
+    return emit_and_exit(result("maggie-browser-session.v1", errors, ttlMinutes=ttl), Path(args.output) if args.output else None)
+
+
+def validate_cache_boundary(args: argparse.Namespace) -> int:
+    evidence = read_json(Path(args.evidence))
+    errors: list[str] = []
+    if evidence.get("schemaVersion") != "maggie-public-session-cache.v1":
+        errors.append("evidence schemaVersion must be maggie-public-session-cache.v1")
+    if evidence.get("publicHtmlVariesBySession") is not False:
+        errors.append("publicHtmlVariesBySession must be false")
+    if evidence.get("sessionCookieHttpOnly") is not True:
+        errors.append("sessionCookieHttpOnly must be true")
+    if evidence.get("identityHintCookieReadable") is not True:
+        errors.append("identityHintCookieReadable must be true")
+    if evidence.get("identityRequestWhenHintAbsent") is not False:
+        errors.append("identityRequestWhenHintAbsent must be false")
+    return emit_and_exit(result("maggie-public-session-cache.v1", errors), Path(args.output) if args.output else None)
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(prog="maggie contracts")
     sub = parser.add_subparsers(dest="command", required=True)
@@ -270,6 +369,18 @@ def main() -> int:
     capabilities = sub.add_parser("capabilities-validate")
     capabilities.add_argument("--manifest", required=True); capabilities.add_argument("--output")
     capabilities.set_defaults(func=validate_capabilities)
+    style = sub.add_parser("style-check")
+    style.add_argument("--manifest", required=True); style.add_argument("--output")
+    style.set_defaults(func=validate_style_editing)
+    overrides = sub.add_parser("content-overrides-check")
+    overrides.add_argument("--manifest", required=True); overrides.add_argument("--output")
+    overrides.set_defaults(func=validate_content_overrides)
+    session = sub.add_parser("session-check")
+    session.add_argument("--manifest", required=True); session.add_argument("--output")
+    session.set_defaults(func=validate_session_contract)
+    cache = sub.add_parser("cache-boundary-check")
+    cache.add_argument("--evidence", required=True); cache.add_argument("--output")
+    cache.set_defaults(func=validate_cache_boundary)
     args = parser.parse_args()
     try:
         return args.func(args)

package/bundled-tools/clis/maggie_design.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 
 import argparse
 import hashlib
+import html as html_lib
 import json
 import re
 import shutil
@@ -82,6 +83,50 @@ def rendered_asset_preflight(template: Path) -> list[str]:
     return errors
 
 
+def source_anchor_start(source: str, tag: str, reported_offset: int) -> int:
+    """Resolve an Astro compiler offset to the opening bracket of an element."""
+    if not re.fullmatch(r"[A-Za-z][A-Za-z0-9:-]*", tag):
+        raise ValueError("tag name is invalid")
+    bound = max(0, min(len(source), int(reported_offset) + 1))
+    start = source.rfind("<" + tag, 0, bound)
+    if start < 0:
+        raise ValueError(f"opening tag not found near compiler offset: {tag}")
+    return start
+
+
+def decode_content_text(value: str) -> str:
+    """Decode markup entities once and refuse unknown/double-escaped entities."""
+    decoded = html_lib.unescape(value)
+    if re.search(r"&(?:[A-Za-z][A-Za-z0-9]+|#\d+|#x[0-9A-Fa-f]+);", decoded):
+        raise ValueError("text contains an unknown or double-escaped HTML entity")
+    return decoded
+
+
+def markup_check(html_path: Path, require_keys: bool) -> int:
+    source = html_path.read_text(encoding="utf-8")
+    errors: list[str] = []
+    if re.search(r"\bstyle\s*=\s*([\"'])\s*\1", source, re.I):
+        errors.append("empty style attributes must be omitted")
+    keys = re.findall(r"\bdata-maggie-content-key\s*=\s*[\"']([^\"']+)[\"']", source, re.I)
+    duplicates = sorted({key for key in keys if keys.count(key) > 1})
+    if duplicates:
+        errors.append("duplicate content keys: " + ", ".join(duplicates))
+    if require_keys:
+        for match in re.finditer(r"<(p|h[1-6]|li|button|a|span)\b([^>]*)>([^<>]+)</\1>", source, re.I | re.S):
+            attrs, text = match.group(2), " ".join(match.group(3).split())
+            if text and not re.search(r"\bdata-maggie-content-key\s*=", attrs, re.I):
+                errors.append(f"editable text node lacks data-maggie-content-key: {match.group(1)}")
+            try:
+                decode_content_text(match.group(3))
+            except ValueError as error:
+                errors.append(str(error))
+    result = {"schemaVersion": "maggie-design-markup.v1", "passed": not errors,
+              "errors": errors, "contentKeyCount": len(keys), "requireKeys": require_keys,
+              "source": str(html_path.resolve())}
+    print(json.dumps(result, indent=2, ensure_ascii=False))
+    return 0 if not errors else 1
+
+
 def _surface_list(value: str) -> list[str]:
     surfaces = [item.strip().lower() for item in value.split(",") if item.strip()]
     invalid = sorted(set(surfaces) - set(REFERENCE_SURFACES))
@@ -808,6 +853,7 @@ commands:
   status       show a design job and its per-step progress
   resume       restart a failed design workflow
   author       plan an original first-party page
+  markup-check validate optional style attributes, content keys, and entities
   reference-ui, init, validate-ui, app-init, app-validate, rebrand, review
 """)
         return 0
@@ -823,6 +869,15 @@ commands:
             return reference_ui(args.project, args.reference, _surface_list(args.surface), args.screenshots_dir, args.confirm)
         except (OSError, ValueError, json.JSONDecodeError) as error:
             print(f"BLOCKED: maggie-design reference-ui: {error}", file=sys.stderr); return 1
+    if len(sys.argv) > 1 and sys.argv[1] == "markup-check":
+        command = argparse.ArgumentParser(description="Validate generated markup before it is made editable.")
+        command.add_argument("--html", type=Path, required=True)
+        command.add_argument("--require-content-keys", action="store_true")
+        args = command.parse_args(sys.argv[2:])
+        try:
+            return markup_check(args.html, args.require_content_keys)
+        except (OSError, ValueError) as error:
+            print(f"BLOCKED: maggie-design markup-check: {error}", file=sys.stderr); return 1
     if len(sys.argv) > 1 and sys.argv[1] == "init":
         command = argparse.ArgumentParser(description="Initialize a native blog or service UI plan from a sanitized reference manifest.")
         command.add_argument("--project", type=Path, default=Path.cwd())