@topy-ai/maggie 0.7.46 → 0.7.48

package/bundled-tools/clis/maggie_clone_to_template.py

@@ -58,6 +58,8 @@ def job_args(job: dict, marketplace: Path, template_id: str) -> argparse.Namespa
     values.setdefault("tag", [])
     values.setdefault("site_url", None)
     values.setdefault("sample", None)
+    values.setdefault("display_name", None)
+    values.setdefault("display_description", None)
     return argparse.Namespace(**values)
 
 
@@ -169,6 +171,7 @@ def plan_job(args: argparse.Namespace) -> int:
         "options": {
             "provider": args.provider, "brand": args.brand, "category": args.category,
             "tag": args.tag, "site_url": args.site_url, "sample": str(args.sample) if args.sample else None,
+            "display_name": getattr(args, "display_name", None), "display_description": getattr(args, "display_description", None),
         },
         "history": [{"phase": "STARTED", "at": now()}],
     }
@@ -222,6 +225,13 @@ def package_step(args: argparse.Namespace) -> int:
         command.extend(("--site-url", options.site_url))
     if options.sample:
         command.extend(("--sample", str(options.sample)))
+    # The customer-facing style name is neutral and separate from source
+    # evidence; without an explicit name the importer derives one from the
+    # measured design and checks it against the source brand and catalog.
+    if options.display_name:
+        command.extend(("--display-name", options.display_name))
+    if options.display_description:
+        command.extend(("--display-description", options.display_description))
     try:
         result = subprocess.run(command, cwd=marketplace.parent)
         template = marketplace / "templates" / template_id
@@ -363,6 +373,8 @@ def main() -> int:
     plan_parser.add_argument("--category", action="append", default=[])
     plan_parser.add_argument("--tag", action="append", default=[])
     plan_parser.add_argument("--sample", type=Path)
+    plan_parser.add_argument("--display-name", help="neutral customer-facing style name; never the source brand")
+    plan_parser.add_argument("--display-description")
     plan_parser.add_argument("--force", action="store_true")
     plan_parser.set_defaults(func=plan_job)
     for name, func, help_text in (
@@ -390,6 +402,8 @@ def main() -> int:
     run_parser.add_argument("--category", action="append", default=[])
     run_parser.add_argument("--tag", action="append", default=[])
     run_parser.add_argument("--sample", type=Path)
+    run_parser.add_argument("--display-name", help="neutral customer-facing style name; never the source brand")
+    run_parser.add_argument("--display-description")
     run_parser.add_argument("--force", action="store_true")
     run_parser.set_defaults(func=run)
     status_parser = sub.add_parser("status", help="inspect a URL-to-template job")

package/bundled-tools/clis/maggie_deployment.py

@@ -3,7 +3,10 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
+import inspect
 import json
+import os
 import re
 import shlex
 import subprocess
@@ -78,6 +81,238 @@ def credential_preflight_main(argv: list[str]) -> int:
     return 0 if result["passed"] else 1
 
 
+ENV_KEY_RE = re.compile(r"[A-Za-z_][A-Za-z0-9_]{0,127}")
+SHA256_RE = re.compile(r"[0-9a-f]{64}")
+DATABASE_URL_KEYS = ("DATABASE_URL", "POSTGRES_URL", "POSTGRES_PRISMA_URL", "PG_URL", "MYSQL_URL", "MONGODB_URI", "REDIS_URL")
+DATABASE_HOST_KEYS = ("DB_HOST", "PGHOST", "POSTGRES_HOST", "MYSQL_HOST", "DATABASE_HOST")
+LOCAL_DATABASE_HOSTS = {"localhost", "127.0.0.1", "::1", "0.0.0.0", "db", "postgres", "host.docker.internal"}
+
+
+def env_fingerprint(value: str) -> str:
+    return hashlib.sha256(value.encode("utf-8")).hexdigest()
+
+
+def fingerprint_manifest(env_file: Path, host: str, keys: list[str] | None = None) -> dict:
+    """Return key names and SHA-256 fingerprints only; values never leave this function."""
+    values = parse_env_file(env_file)
+    selected = sorted(set(keys)) if keys else sorted(values)
+    return {
+        "schemaVersion": "maggie-env-fingerprints.v1",
+        "host": host,
+        "keys": {key: env_fingerprint(values[key]) for key in selected if values.get(key, "").strip()},
+        "valuesReturned": False,
+    }
+
+
+def load_fingerprint_manifest(path: Path) -> dict:
+    """Read a JSON manifest or the `KEY <sha256>` lines emitted by the no-echo shell snippet."""
+    text = path.read_text(encoding="utf-8")
+    try:
+        value = json.loads(text)
+    except json.JSONDecodeError:
+        keys = {}
+        for line in text.splitlines():
+            parts = line.split()
+            if len(parts) == 2:
+                keys[parts[0]] = parts[1].lower()
+        value = {"schemaVersion": "maggie-env-fingerprints.v1", "host": path.stem, "keys": keys}
+    if not isinstance(value, dict) or not isinstance(value.get("keys"), dict):
+        raise ValueError(f"fingerprint manifest is invalid: {path.name}")
+    keys = {}
+    for key, digest in value["keys"].items():
+        if not ENV_KEY_RE.fullmatch(str(key)) or not SHA256_RE.fullmatch(str(digest)):
+            raise ValueError(f"fingerprint manifest {path.name} must contain only env names and SHA-256 hex digests")
+        keys[str(key)] = str(digest)
+    # The empty-string digest is what the snippet prints for an unset key.
+    empty = env_fingerprint("")
+    return {"host": str(value.get("host") or path.stem), "keys": {key: digest for key, digest in keys.items() if digest != empty}}
+
+
+def secret_parity(hosts: list[dict], required: list[str], strict: bool = False) -> dict:
+    """Compare env names and fingerprints across hosts; output carries short fingerprints only."""
+    errors: list[str] = []
+    warnings: list[str] = []
+    names = [host["host"] for host in hosts]
+    if len(hosts) < 2:
+        errors.append("at least two hosts are required for a parity check")
+    if len(set(names)) != len(names):
+        errors.append("host names must be unique")
+    required_names = sorted({name.strip() for name in required if name.strip()})
+    invalid = [name for name in required_names if not ENV_KEY_RE.fullmatch(name)]
+    if invalid:
+        errors.append("required names must be environment variable names")
+    union = sorted(set().union(*(host["keys"] for host in hosts)) | set(required_names)) if hosts else required_names
+    keys = []
+    for key in union:
+        present = {host["host"]: host["keys"][key] for host in hosts if key in host["keys"]}
+        missing = [name for name in names if name not in present]
+        distinct = sorted(set(present.values()))
+        status = "ok"
+        if missing:
+            status = "missing"
+        elif len(distinct) > 1:
+            status = "mismatch"
+        is_required = key in required_names
+        keys.append({
+            "key": key,
+            "required": is_required,
+            "status": status,
+            "missingOn": missing,
+            "fingerprints": {name: digest[:12] for name, digest in present.items()} if status == "mismatch" else {},
+        })
+        if status != "ok":
+            message = f"{key} is {status}" + (f" on {', '.join(missing)}" if missing else " across hosts")
+            (errors if is_required or strict else warnings).append(message)
+    return {
+        "schemaVersion": "maggie-secret-parity.v1",
+        "hosts": names,
+        "required": required_names,
+        "keys": keys,
+        "valuesReturned": False,
+        "passed": not errors,
+        "errors": errors,
+        "warnings": warnings,
+        "mutation": "not executed",
+    }
+
+
+def secret_parity_main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="maggie deployment secret-parity",
+        description="Compare env key names and SHA-256 fingerprints across hosts without printing values.",
+    )
+    parser.add_argument("--host", action="append", default=[], metavar="NAME=ENV_FILE", help="local env file for one host; repeat")
+    parser.add_argument("--manifest", action="append", default=[], help="fingerprint manifest produced on a host; repeat")
+    parser.add_argument("--required", action="append", default=[], help="required key name; repeat")
+    parser.add_argument("--strict", action="store_true", help="fail on optional keys that differ, not only required keys")
+    parser.add_argument("--output")
+    args = parser.parse_args(argv)
+    hosts = []
+    for item in args.host:
+        name, separator, path = item.partition("=")
+        if not separator or not name or not path:
+            parser.error("--host must be NAME=ENV_FILE")
+        hosts.append({"host": name, "keys": fingerprint_manifest(Path(path).expanduser(), name)["keys"]})
+    for path in args.manifest:
+        hosts.append(load_fingerprint_manifest(Path(path).expanduser()))
+    result = secret_parity(hosts, args.required, args.strict)
+    if args.output:
+        output = Path(args.output).resolve()
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(json.dumps(result, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    print(json.dumps(result, indent=2, ensure_ascii=False))
+    return 0 if result["passed"] else 1
+
+
+def secret_fingerprint_main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="maggie deployment secret-fingerprint",
+        description="Write a host's env key names and SHA-256 fingerprints (never values) for secret-parity.",
+    )
+    parser.add_argument("--env-file", required=True)
+    parser.add_argument("--host", required=True, help="stable host label, e.g. api-1")
+    parser.add_argument("--key", action="append", default=[], help="limit to these key names; repeat")
+    parser.add_argument("--output")
+    args = parser.parse_args(argv)
+    result = fingerprint_manifest(Path(args.env_file).expanduser(), args.host, args.key or None)
+    text = json.dumps(result, indent=2, ensure_ascii=False) + "\n"
+    if args.output:
+        output = Path(args.output).resolve()
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(text, encoding="utf-8")
+    print(text, end="")
+    return 0
+
+
+def database_targets(values: dict[str, str]) -> list[dict]:
+    """Extract database host/port/name per key; credentials are discarded."""
+    from urllib.parse import urlsplit
+
+    targets = []
+    for key, value in values.items():
+        if not value:
+            continue
+        if key in DATABASE_URL_KEYS or key.endswith("_DATABASE_URL") or key.endswith("_DB_URL"):
+            try:
+                parsed = urlsplit(value)
+                host = (parsed.hostname or "").lower()
+                port = parsed.port
+            except ValueError:
+                continue
+            if host:
+                targets.append({"key": key, "host": host, "port": port, "database": parsed.path.lstrip("/") or None})
+        elif key in DATABASE_HOST_KEYS:
+            targets.append({"key": key, "host": value.lower(), "port": None, "database": None})
+    return targets
+
+
+def environment_isolation(local_env: Path, production_env: Path | None = None, production_hosts: list[str] | None = None) -> dict:
+    """Fail when a local env file points at the production database."""
+    errors: list[str] = []
+    warnings: list[str] = []
+    local = database_targets(parse_env_file(local_env)) if local_env.is_file() else []
+    production = database_targets(parse_env_file(production_env)) if production_env and production_env.is_file() else []
+    production += [{"key": "--production-db-host", "host": host.lower(), "port": None, "database": None} for host in production_hosts or [] if host]
+    if not local:
+        warnings.append("no database connection setting found in the local env file")
+    if not production:
+        warnings.append("no production database host provided; pass --production-env or --production-db-host")
+    findings = []
+    for item in local:
+        if item["host"] in LOCAL_DATABASE_HOSTS:
+            continue
+        for prod in production:
+            if item["host"] != prod["host"]:
+                continue
+            same_port = item["port"] is None or prod["port"] is None or item["port"] == prod["port"]
+            same_database = item["database"] is None or prod["database"] is None or item["database"] == prod["database"]
+            shared = same_port and same_database
+            findings.append({"localKey": item["key"], "productionKey": prod["key"], "host": item["host"], "sameDatabase": shared})
+            if shared:
+                errors.append(f"{item['key']} points at the production database host {item['host']}; local test data will reach live pages and workers")
+            else:
+                warnings.append(f"{item['key']} uses the production database server {item['host']} with a different database or port")
+    return {
+        "schemaVersion": "maggie-environment-isolation.v1",
+        "localTargets": [{key: item[key] for key in ("key", "host", "port")} for item in local],
+        "productionHosts": sorted({item["host"] for item in production}),
+        "findings": findings,
+        "credentialsReturned": False,
+        "passed": not errors,
+        "errors": errors,
+        "warnings": warnings,
+        "mutation": "not executed",
+    }
+
+
+def environment_isolation_main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="maggie deployment env-isolation",
+        description="Check that local development does not use the production database.",
+    )
+    parser.add_argument("--project", default=".")
+    parser.add_argument("--local-env", help="defaults to PROJECT/.env")
+    parser.add_argument("--production-env", help="production env file (read locally; values are not printed)")
+    parser.add_argument("--production-db-host", action="append", default=[], help="production database hostname; repeat")
+    parser.add_argument("--output")
+    args = parser.parse_args(argv)
+    project = Path(args.project).expanduser().resolve()
+    hosts = list(args.production_db_host)
+    if os.environ.get("MAGGIE_PRODUCTION_DB_HOST"):
+        hosts.append(os.environ["MAGGIE_PRODUCTION_DB_HOST"])
+    result = environment_isolation(
+        Path(args.local_env).expanduser().resolve() if args.local_env else project / ".env",
+        Path(args.production_env).expanduser().resolve() if args.production_env else None,
+        hosts,
+    )
+    if args.output:
+        output = Path(args.output).resolve()
+        output.parent.mkdir(parents=True, exist_ok=True)
+        output.write_text(json.dumps(result, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    print(json.dumps(result, indent=2, ensure_ascii=False))
+    return 0 if result["passed"] else 1
+
+
 def _secret_names(payload: object) -> list[str]:
     """Extract only binding names from a Wrangler secret-list response."""
     entries: object = payload
@@ -300,6 +535,14 @@ def preflight(
         "commands": {key: scripts[key] for key in ("build", "test", "lint", "typecheck", "deploy") if key in scripts},
         "next_action": "review target, environment, migrations, secrets, and rollback owner before execute",
     }
+    isolation_warnings: list[str] = []
+    production_env = next((path for path in (project / ".env.production", project / ".env.prod") if path.is_file()), None)
+    production_host = os.environ.get("MAGGIE_PRODUCTION_DB_HOST", "").strip()
+    if (project / ".env").is_file() and (production_env or production_host):
+        isolation = environment_isolation(project / ".env", production_env, [production_host] if production_host else [])
+        result["environment_isolation"] = {"passed": isolation["passed"], "productionHosts": isolation["productionHosts"], "errors": isolation["errors"]}
+        result["checks"]["local_database_isolated"] = isolation["passed"]
+        isolation_warnings = [f"environment isolation: {message}" for message in isolation["errors"]]
     if target in {"vps", "vps-with-cloudflare-dns"}:
         result["provider"] = "vps"
         result["architecture"] = "Astro Node standalone behind Nginx, managed by systemd, with release/current rollback layout"
@@ -352,11 +595,16 @@ def preflight(
         result["delegation"] = delegation
         result["vps"] = {"runtime":"Node.js standalone","reverseProxy":"Nginx","processManager":"systemd","releaseLayout":"/var/www/<site>/releases/<release> + current symlink","dns":"Cloudflare DNS or registrar DNS; verify apex and www separately","remoteCommands":["npm ci","npm run build","systemctl restart <service>","systemctl is-active <service>","curl -fsS https://<domain>/robots.txt","curl -fsS https://<domain>/sitemap.xml"],"handoverFields":["host","sshUser","domain","service","release","previousRelease","nginxConfig","migrationVersion","verification","rollback"]}
         result["next_action"] = "review VPS host, SSH user, domain/DNS, systemd service, Nginx config, release path, migrations, and rollback owner before execute"
+        runners = sorted(deployment_dir.rglob("release-runner.sh")) if deployment_dir.exists() else []
+        result["release_runners"] = [release_runner_status(path) for path in runners[:25]]
+        result["warnings"] = isolation_warnings + [f"generated release runner is stale or unmarked: {item['path']}" for item in result["release_runners"] if item["status"] == "stale"]
         result["blocking_checks"] = ["package_manifest", "build_command", "env_example", "node_runtime_declared", "start_command_or_runtime", "stateless_or_migration_plan", "release_layout_declared", "rollback_command_declared", "release_retention_policy", "data_release_checkpoint", "release_plan_artifact", "systemd_artifact", "nginx_artifact", "deployment_artifacts_secret_free", "rollback_evidence"]
         if require_deployer:
             result["blocking_checks"].append("deployer_delegation")
     else:
         result["blocking_checks"] = ["package_manifest", "build_command", "env_example"]
+        if isolation_warnings:
+            result["warnings"] = isolation_warnings
     return result
 
 
@@ -549,15 +797,51 @@ WantedBy=multi-user.target
     (output_dir / f"{domain}.conf").write_text(nginx, encoding="utf-8")
 
 
+def release_runner_generator() -> dict[str, str]:
+    version = os.environ.get("MAGGIE_VERSION", "").strip()
+    if not version:
+        version_file = Path(__file__).resolve().parents[2] / "VERSION"
+        try:
+            version = version_file.read_text(encoding="utf-8").strip()
+        except OSError:
+            version = "unknown"
+    source = inspect.getsource(release_runner).encode("utf-8")
+    return {"version": version, "fingerprint": hashlib.sha256(source).hexdigest()[:16]}
+
+
+def release_runner_status(path: Path) -> dict:
+    try:
+        content = path.read_text(encoding="utf-8", errors="replace")
+    except OSError as error:
+        return {"path": str(path), "status": "stale", "reason": f"runner cannot be read: {error}", "refresh": "Regenerate from the reviewed VPS plan and inspect the diff."}
+    match = re.search(r"^# Maggie release runner: generator=([^ ]+) template=([a-f0-9]{16})$", content, re.MULTILINE)
+    current = release_runner_generator()
+    if not match:
+        return {"path": str(path), "status": "stale", "reason": "runner has no generator version/fingerprint", "currentGenerator": current, "refresh": "Regenerate from the reviewed VPS plan and inspect the diff before replacing this file."}
+    generated = {"version": match.group(1), "fingerprint": match.group(2)}
+    stale = generated != current
+    return {
+        "path": str(path),
+        "status": "stale" if stale else "current",
+        "generatedBy": generated,
+        "currentGenerator": current,
+        "reason": "runner generator version or template fingerprint has changed" if stale else "runner matches the current generator",
+        "refresh": "Regenerate from the reviewed VPS plan and inspect the diff before replacing this file." if stale else "",
+    }
+
+
 def release_runner(plan: dict) -> str:
     """Render the ordered, reviewable VPS runner for one release."""
     root = plan["release_root"]
     service = plan["service"]
     domain = plan["domain"]
     current = plan["current_release"]
+    generator = release_runner_generator()
     return f'''#!/usr/bin/env bash
 set -euo pipefail
 
+# Maggie release runner: generator={generator["version"]} template={generator["fingerprint"]}
+
 # Migration precedes the symlink flip; later releases carry agent state.
 : "${{RELEASE_ID:?set RELEASE_ID to an immutable release name}}"
 RELEASE_KIND="${{RELEASE_KIND:-upgrade}}"
@@ -636,6 +920,12 @@ def main() -> int:
         return credential_preflight_main(sys.argv[2:])
     if sys.argv[1:2] == ["worker-secrets"]:
         return worker_secret_preflight_main(sys.argv[2:])
+    if sys.argv[1:2] == ["secret-parity"]:
+        return secret_parity_main(sys.argv[2:])
+    if sys.argv[1:2] == ["secret-fingerprint"]:
+        return secret_fingerprint_main(sys.argv[2:])
+    if sys.argv[1:2] == ["env-isolation"]:
+        return environment_isolation_main(sys.argv[2:])
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("project", nargs="?", default=".")
     parser.add_argument("--target", choices=("detected", "cloudflare", "vps", "vps-with-cloudflare-dns", "gcp", "aws"), default="detected")
@@ -653,6 +943,7 @@ def main() -> int:
     parser.add_argument("--deployer-evidence", help="delegation evidence JSON; defaults to .maggie/deployment/deployer-delegation.json")
     parser.add_argument("--plan-dir", help="directory for generated VPS artifacts")
     parser.add_argument("--runner-output", help="write a reviewable ordered VPS release runner")
+    parser.add_argument("--check-runner", help="read-only check of a generated runner's Maggie version and template fingerprint")
     parser.add_argument("--retention-plan", action="store_true", help="create a read-only release prune candidate plan")
     parser.add_argument("--current-link", help="current symlink for --retention-plan")
     parser.add_argument("--keep-releases", type=int, default=2)
@@ -665,6 +956,10 @@ def main() -> int:
     parser.add_argument("--has-auth", action="store_true")
     args = parser.parse_args()
     try:
+        if args.check_runner:
+            report = release_runner_status(Path(args.check_runner).expanduser().resolve())
+            print(json.dumps(report, indent=2, ensure_ascii=False))
+            return 0
         if args.verify_deployer:
             if not args.deployer_host:
                 parser.error("--deployer-host is required with --verify-deployer")

package/bundled-tools/clis/maggie_design.py

@@ -854,9 +854,18 @@ commands:
   resume       restart a failed design workflow
   author       plan an original first-party page
   markup-check validate optional style attributes, content keys, and entities
+  pressable-check flag pressables/buttons nested in another pressable (JSX/TSX)
+  layer-check  flag unlayered CSS that overrides Tailwind v4 utilities
+  palette      generate or validate a semantic palette role contract
   reference-ui, init, validate-ui, app-init, app-validate, rebrand, review
 """)
         return 0
+    if len(sys.argv) > 1 and sys.argv[1] in {"pressable-check", "layer-check"}:
+        from maggie_design_lint import main as lint_main
+        return lint_main(sys.argv[1:])
+    if len(sys.argv) > 1 and sys.argv[1] == "palette":
+        from maggie_palette import main as palette_main
+        return palette_main(sys.argv[2:])
     if len(sys.argv) > 1 and sys.argv[1] == "reference-ui":
         command = argparse.ArgumentParser(description="Record sanitized blog/service UI evidence from a read-only reference project.")
         command.add_argument("--project", type=Path, default=Path.cwd())