@topy-ai/maggie 0.7.52 → 0.7.54

package/README-zh-TW.md

@@ -29,7 +29,31 @@ npx @topy-ai/maggie init --scope project --agent all
 npx @topy-ai/maggie doctor --scope project --project .
 ```
 
-目前 npm 版本為 `0.7.52`：加入三項 mobile lane 後續修正——`maggie mobile preflight` 會在 non-interactive `eas update` script 缺少 `--environment` 時失敗，並在 build 後修改 `eas.json` 可能改變 fingerprint（OTA 更新會無聲地送不到該 build）時警告；`maggie mobile plan` 一律帶 `--environment`，每次 update 前先跑 `eas fingerprint:compare`；新增 `maggie design safe-area-check`，標出 iOS modal route 與 React Native `<Modal>` 內的 `<SafeAreaView>`（可能量到 0 的 top inset）。前一版 `0.7.51` 完成 batch 28：17 條 hosted feedback，來自一個跨平台產品開發 session（同一套 Expo 程式碼支援 web、iOS、Android，加上具備 MCP 與 ChatGPT/Claude app 的 AI 助理、產品自己的 CLI/MCP 套件、第三方 skills catalog 以及多租戶 assistant bridge host）。`maggie design app-validate` 改讀每個 viewport 的 evidence（scroll owner、固定 header/footer），只有 `app-init --pane list-detail:1024:2` 宣告的多欄版面才允許多個 scroll owner，並以 PNG 實際尺寸對照 plan viewport；`app-init --capabilities none|camera,…`（或 `--camera none`）讓非相機頁面不必填相機狀態，`--pattern` 加入新的 app UI patterns 驗收規則。新增 `maggie design app-collect`：在同一個瀏覽器分頁逐一以真實尺寸渲染已登入的 app 路由、略過 React Native Web 的包裝層計算 scroll owner、證明固定 shell，並寫出 `runtime-evidence.json` 與截圖（可 `--cdp-url` 接上已登入的 Chrome，或用專用 QA profile，`--read-only` 阻擋寫入）。新增 `maggie qa app-preflight`：偵測以 `CI=1` 或從錯誤資料夾啟動的 Metro/Expo dev server，並對會輪替的 refresh token 與連到 production API 的本機 server 發出警告。新增 `maggie-mobile-app` skill 與 `maggie mobile preflight|plan`（EAS build profile、TestFlight / Play 內部測試、EAS Update channel 與 fingerprint runtime policy、上架審核規則、建置前成本提示；`--auto-submit` 缺 `ascAppId` 或 `appVersion` policy 配上 remote build number 時在花費額度前就失敗）。新增 `maggie-assistant-tools` skill 與 `maggie assistant`（單一 tool registry、風險等級與 gate、與 model description 分開的使用者文案、由風險推導 MCP annotations、自動產生「助理能做與不能做」頁面、audit 檢查與簽章一次性 approval token 參考實作）。新增 `maggie product release-check|smoke|mcp-check|review-status`（產品 npm CLI/MCP 套件 metadata、`server.json`/`mcpName`、打包檔案機密掃描、安裝後 binary smoke、OAuth protected-resource metadata、ChatGPT/Claude/商店審核追蹤）、`maggie skills scaffold|validate|package|smoke`（第三方 skills catalog 打包成分類 plugin、all-in-one plugin 與 Claude Code `marketplace.json`）、`maggie deployment bridge-plan|bridge-collect-script|bridge-check`（多租戶 bridge host）；`maggie feedback session-summary` 支援多個 repo 與一般句子形式的 commit。MaggieDash 0.2.12 從 ORA host 上游通用修正。前一版 `0.7.50`：`maggie update` 改為 idempotent，內容已與套件相同的檔案不再改寫（保留時間戳），摘要分別列出 changed/unchanged/preserved 數量，只有真的保留了本機修改時才顯示 preserved 提示。前一版 `0.7.49` 完成 batch 27：33 條 2026-09-09 至 09-16 建立但從未提交的本機 feedback drafts，已逐條對照目前程式碼（其中兩條已被既有功能滿足）。新增離線 `maggie ops notifications`（通知 catalogue 合約、consent/retention/durable lead delivery 規則、provider template drift、只檢查變數名稱的 Resend preflight、queue health 門檻與 operator alerts、dry-run retention plan）；`maggie localization email-matrix` 與 `maggie localization lifecycle`（locale 優先順序、未翻譯/缺漏 locale、變數與 HTML/text 一致、market CTA route、consent-aware 行銷 email 預設不發送）；Deployment 的 `--keep-releases` 統一 retention policy、`auth-canary`、資料庫 owner 無法讀取 release 路徑時的 streamed migration、`collect` 單一 readiness report；Google failure remediation（`maggie ops google-diagnose`）與唯讀 `google-ads-preflight`/`google-ads-keyword-ideas`；Social Share `reconcile`（timeout 後不重複發文）、`maggie-marketing-run-v1` 合約、命名排程層與只管制對外發布的 regulated-content review；`maggie design icon-glyph-check`、`maggie design verify`、`maggie service import-stages-validate`/`import-readiness`/`fact-provenance`；以及 `--release-metadata` 版本一致性檢查、`maggie docs rollout-status` 與 stdin batch 輸入。前一版 `0.7.48` 處理 2026-10-10 的 27 條 hosted feedback（batch 26）：Social Share 新增 `adapters`（每個 provider 一組 canonical OAuth scope，LinkedIn 不同 scope 會撤銷舊 token；共用 OAuth client 警告）、`connections`（撤銷或無法解密的 token 標為 `needs_reconnect`，偵測會過期的簽名頭像 URL）、`queue`（slot-based 排程：not-before、最新優先、campaign 輪流與每日上限、DST-safe）與 `campaigns`（idea stage Start gate）；Deployment 新增 hash-only `secret-fingerprint`/`secret-parity`、`env-isolation`（本機 `.env` 指向 production database 時警告）、release retention 與 worker-before-enqueue 發布順序；QA 在未明確同意時阻擋對 production API 的寫入情境，並以 `maggie qa cors-preflight` 只用 OPTIONS 檢查每個 HTTP method；Design 新增 `pressable-check`、`layer-check`（Tailwind v4 unlayered CSS）、onboarding wizard/picker 模式與 `maggie-palette-roles-v1` palette generate/validate；Marketplace 加入 screenshot 完整性與像素預算、從 CSS 量測 palette、asset provenance、中性 `displayName`（全部模板已補齊）、template studio、`maggie-template-content-v1` 合約與圖片生成成本/無文字審查 gate；Booking 新增唯讀 Stripe live setup runbook 與 gift voucher lifecycle 合約（`maggie booking voucher-contract --ledger`）；Feedback 新增 `improvement` 類型與 `maggie feedback session-summary`。MaggieDash 0.2.11 會保留尚未部署 template 的 outbox email 而不是 dead-letter，並從 ORA host 上游通用修正。本版也包含 Booking 十個 email events 合約與 CLI validator 同步及安全輸出的 `arrivalNote`。前一版 `0.7.47` 處理 2026-09-26 五條新 feedback：project-scope
+目前 npm 版本為 `0.7.54`：完成 feedback batch 30，共 13 條 feedback，來自一個在自家網站上執行 MaggieDash 的內容與社群產品，並同步發布 MaggieDash 0.2.14。
+
+- **MaggieDash 先裝核心**：`maggie dash install` 現在只安裝儀表板、登入、`/_maggie/admin` 路由與核心資料表。接著讀取專案（框架、既有登入、資料庫、金流、是否提供服務或經營 Blog、語言），逐項推薦選配模組並說明原因。沒有你的指示不會安裝任何選配：`maggie dash add booking --confirm`（或 `maggie booking install`）。純內容網站不再被裝上 Stripe、預約路由與 worker。`maggie dash recommend` 可隨時重新分析。
+- **MaggieDash 0.2.14 不再把密鑰寫進 build**：Astro scaffold 以 `import.meta.env` 讀取伺服器設定，Vite 會把它寫進建置輸出；只要 build 時環境中有 `DATABASE_URL` 或 `BOOKING_TOKEN_SECRET`，就會出現在 `dist/server`。現在改為執行時讀取，用舊 scaffold 安裝的 host 請重新 build。管理介面側欄只顯示 host 實際提供的面板（capability manifest）；從 GitHub 安裝時也會拿到 Booking 的 env 範例檔。
+- **agent 資料夾不再有特定客戶的文件**：舊版會把某個客戶的整合稽核、進度記錄與交付看板裝進 `~/.claude/references` 與 `~/.codex/references`。現在只打包一般性的 Booking 文件。打包時若有檔案提到客戶，或連到沒有打包的文件，release gate 會直接失敗。`maggie update` 會移除舊版裝了、新版不再提供、且你沒改過的檔案；`maggie doctor --scope user` 會列出剩下的。
+- **Feedback 一定送得到**：`maggie feedback submit` 不需要 `--endpoint`。先送 NoBlox；只有在該主機儲存前失敗（連不上或 526 之類的 5xx）才改送 `feedback.cmo.so`，兩邊都以 `feedbackId` 去重。
+- **社群貼文**：
+  - `link-check`（及 `plan --check-link`）在規劃貼文前排除連結已失效（404／410）的文章；被擋或暫時出錯的頁面會保留。
+  - `pictures` 確保同一個點子寫給多個頻道的貼文共用同一張圖。
+- **Blog API Pull**：`maggie blog live-urls` 記錄已交付文章的實際上線網址（來自網站回報或 sitemap 比對）。比對只會新增、不會撤回先前的結果，且優先採用原文頁而不是翻譯頁。
+- **大量產生的頁面**：
+  - `maggie design bulk` 用同一份 brief、facts 與 validator 產生大量相似頁面：只替已通過驗證、之後沒再改過的頁面畫圖；頁面被改過，寫手必須重新讀取；規則收緊時，先前通過的頁面會退回重新驗證；所有頁面都通過才寫入。
+  - `maggie localization key-check` 找出需要「每頁位置 key」而不能共用文字 key 的翻譯。
+  - `maggie localization fragments` 找出被品牌名切成太短、無法單獨翻譯的片段。
+- **圖片**：`maggie media generate --engine codex|gemini` 產生圖片；`maggie media engine-plan` 在大量產生前列出各引擎的時間與費用（例如 2400x1000 在 Gemini 會用 21:9、2K）。
+- **App**：
+  - `maggie design sheet-check` 抓出 iOS 凍結問題：關閉 sheet 的同時顯示 toast、重新整理、換頁或開另一個 sheet。
+  - `maggie mobile ota-guard` 只把更新發佈到已安裝 build 擁有的 runtime；在 pnpm monorepo 中，fingerprint 可能因不相關的套件變動而改變。
+- **發佈**：
+  - `maggie deployment preview-auth-check` 找出仍在送資料到已加密碼的 preview 主機的 workflow 與 webhook。
+  - `maggie product published` 等到 staged 的 npm 版本真正成為 `latest`。
+
+前一版 `0.7.53` 完成 feedback batch 29（56 條，來自預約平台與社群／AI 助理產品）：預約規則與共用測試向量、Stripe Connect 平台指引與 `connect-qa`、MaggieDash 0.2.13 預約修正、`cloudflare-preflight`、`vps-release`、`qa fit-check`、`mobile ota --build-ref`、助理 registry 卡片與長期核准、社群只用自家網域文章，以及 `seo origin-check`。
+
+前一版 `0.7.52` 加入 mobile 後續修正（`eas update --environment`、fingerprint 檢查、`maggie design safe-area-check`）。`0.7.51`（batch 28）新增 `maggie design app-collect`、`maggie qa app-preflight`、`maggie-mobile-app` 與 `maggie-assistant-tools` skills，以及 `maggie product`、`maggie skills`、`maggie deployment bridge-*`。前一版 `0.7.50`：`maggie update` 改為 idempotent，內容已與套件相同的檔案不再改寫（保留時間戳），摘要分別列出 changed/unchanged/preserved 數量，只有真的保留了本機修改時才顯示 preserved 提示。前一版 `0.7.49` 完成 batch 27：33 條 2026-09-09 至 09-16 建立但從未提交的本機 feedback drafts，已逐條對照目前程式碼（其中兩條已被既有功能滿足）。新增離線 `maggie ops notifications`（通知 catalogue 合約、consent/retention/durable lead delivery 規則、provider template drift、只檢查變數名稱的 Resend preflight、queue health 門檻與 operator alerts、dry-run retention plan）；`maggie localization email-matrix` 與 `maggie localization lifecycle`（locale 優先順序、未翻譯/缺漏 locale、變數與 HTML/text 一致、market CTA route、consent-aware 行銷 email 預設不發送）；Deployment 的 `--keep-releases` 統一 retention policy、`auth-canary`、資料庫 owner 無法讀取 release 路徑時的 streamed migration、`collect` 單一 readiness report；Google failure remediation（`maggie ops google-diagnose`）與唯讀 `google-ads-preflight`/`google-ads-keyword-ideas`；Social Share `reconcile`（timeout 後不重複發文）、`maggie-marketing-run-v1` 合約、命名排程層與只管制對外發布的 regulated-content review；`maggie design icon-glyph-check`、`maggie design verify`、`maggie service import-stages-validate`/`import-readiness`/`fact-provenance`；以及 `--release-metadata` 版本一致性檢查、`maggie docs rollout-status` 與 stdin batch 輸入。前一版 `0.7.48` 處理 2026-10-10 的 27 條 hosted feedback（batch 26）：Social Share 新增 `adapters`（每個 provider 一組 canonical OAuth scope，LinkedIn 不同 scope 會撤銷舊 token；共用 OAuth client 警告）、`connections`（撤銷或無法解密的 token 標為 `needs_reconnect`，偵測會過期的簽名頭像 URL）、`queue`（slot-based 排程：not-before、最新優先、campaign 輪流與每日上限、DST-safe）與 `campaigns`（idea stage Start gate）；Deployment 新增 hash-only `secret-fingerprint`/`secret-parity`、`env-isolation`（本機 `.env` 指向 production database 時警告）、release retention 與 worker-before-enqueue 發布順序；QA 在未明確同意時阻擋對 production API 的寫入情境，並以 `maggie qa cors-preflight` 只用 OPTIONS 檢查每個 HTTP method；Design 新增 `pressable-check`、`layer-check`（Tailwind v4 unlayered CSS）、onboarding wizard/picker 模式與 `maggie-palette-roles-v1` palette generate/validate；Marketplace 加入 screenshot 完整性與像素預算、從 CSS 量測 palette、asset provenance、中性 `displayName`（全部模板已補齊）、template studio、`maggie-template-content-v1` 合約與圖片生成成本/無文字審查 gate；Booking 新增唯讀 Stripe live setup runbook 與 gift voucher lifecycle 合約（`maggie booking voucher-contract --ledger`）；Feedback 新增 `improvement` 類型與 `maggie feedback session-summary`。MaggieDash 0.2.11 會保留尚未部署 template 的 outbox email 而不是 dead-letter，並從 client host 上游通用修正。本版也包含 Booking 十個 email events 合約與 CLI validator 同步及安全輸出的 `arrivalNote`。前一版 `0.7.47` 處理 2026-09-26 五條新 feedback：project-scope
 `maggie init` 會建立本地 memory store；context 預設只讀取本 project scope；memory hook
 在 local Python adapter 不存在時 fallback 到已安裝 CLI；重複 init 保留既有檔案與時間戳；
 `maggie feedback list` 的 `--project` 可放在子命令前或後。Generated VPS runner 現在記錄
@@ -44,7 +68,7 @@ browser adapter capability preflight、privacy-safe feedback evidence references
 `xdg-open` 的系統 `browse`；feedback graph 不保存 raw payload、logs、credentials
 或本機路徑。另包含 0.7.45 的 Codex/Claude Code 一次性 user-scope 安裝、bundled
 workflow runner 與 user-scope maintenance commands；並完成 2026-09-24 booking feedback batch：MaggieDash
-Calendar availability grid/free-slot entry，以及 ORA modal focus restoration
+Calendar availability grid/free-slot entry，以及 host modal focus restoration
 的驗證證據。另新增 secret-free Starter marketplace provisioning
 plan、versioned GitHub/Cloudflare/Starter contracts，以及 deterministic
 `maggie marketplace plan` dry-run CLI。0.7.42 新增 redacted Gemini video-provider evidence gate，
@@ -63,7 +87,7 @@ authentication 和 isolated dev server 仍由 host 負責。
 dashboard/sample surface contract、primary navigation indexability、privacy
 origin parity、provider-neutral site structure、host capability manifest，
 以及包含 duration/price variants 的 Booking treatment group。MaggieDash
-同步更新至 0.2.9，ORA reference host 也提供相同的 capability/site-structure
+同步更新至 0.2.9，reference host 也提供相同的 capability/site-structure
 邊界。
 
 目前也加入 deferred workflow 的共用 contract gate：Gemini image/edit 使用
@@ -113,7 +137,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 npm 版本為 `0.7.52`，包含 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 npm 版本為 `0.7.54`，包含 batch 30 MaggieDash 先裝核心、release privacy gate、feedback 備援、社群連結與圖片檢查、大量頁面產生與 app 檢查，batch 29 預約規則、部署、app QA、助理與社群功能，以及 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -89,58 +89,86 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 22 installable skills and a local-first MaggieDash foundation.
 
-This package is `0.7.52`. It adds three follow-ups to the mobile
-lane that arrived during the 0.7.51 release: `maggie mobile preflight` fails
-on non-interactive `eas update` scripts without `--environment` and warns
-when `eas.json` can change the fingerprint after a build (OTA updates would
-silently stop reaching it); `maggie mobile plan` always sets `--environment`
-and gates every update on `eas fingerprint:compare`; and the new
-`maggie design safe-area-check` flags `<SafeAreaView>` inside iOS modal routes
-and React Native `<Modal>`, where it can measure a 0 top inset.
-
-The 0.7.51 release closed batch 28: 17 hosted feedback
-records from a cross-platform product session (one Expo codebase for web,
-iOS and Android, an assistant with MCP and ChatGPT/Claude app surfaces,
-product CLI/MCP packages, a third-party skills catalog, and a multi-tenant
-assistant bridge host):
-
-- App surfaces: `maggie design app-validate` reads per-viewport evidence
-  (scroll owners, fixed shell), accepts extra scroll owners only where
-  `app-init --pane list-detail:1024:2` declares them, and checks each PNG's
-  real size against the plan viewport. `app-init --capabilities none|camera,…`
-  (or `--camera none`) drops irrelevant device states, and `--pattern` adds
-  acceptance rules from the new [app UI patterns](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/skills/maggie-design/references/app-ui-patterns.md).
-- New `maggie design app-collect`: renders a signed-in app route one viewport
-  at a time in one browser tab at the real size, counts scroll owners while
-  skipping React Native Web wrappers, proves the fixed shell, and writes
-  `runtime-evidence.json` plus screenshots. It can attach to your signed-in
-  Chrome (`--cdp-url`) or use a QA profile, and can block writes (`--read-only`).
-- New `maggie qa app-preflight`: catches Metro/Expo dev servers started with
-  `CI=1` or from the wrong folder, and warns about rotating refresh tokens and
-  local servers that talk to production APIs.
-- New [`maggie-mobile-app`](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/skills/maggie-mobile-app/SKILL.md) skill and
-  `maggie mobile preflight|plan`: EAS build profiles, TestFlight / Play
-  internal testing, EAS Update channels and the fingerprint runtime policy,
-  store-review rules, and a cost notice. It fails before quota is spent when
-  `--auto-submit` lacks `ascAppId` or `appVersion` runtime policy is combined
-  with remote build numbers.
-- New [`maggie-assistant-tools`](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/skills/maggie-assistant-tools/SKILL.md)
-  skill and `maggie assistant`: one tool registry with risk levels, gates and
-  user-facing copy kept apart from model descriptions, MCP annotations derived
-  from risk, a generated "what the assistant can and can't do" page, audit
-  checks, and reference signed one-time approval tokens.
-- New `maggie product release-check|smoke|mcp-check|review-status` for a
-  product's own npm CLI and MCP packages (metadata, `server.json`/`mcpName`,
-  packed-file secret scan, installed-binary smoke, OAuth protected-resource
-  metadata, ChatGPT/Claude/store review tracking).
-- New `maggie skills scaffold|validate|package|smoke` for third-party skill
-  catalogs, packaging category plugins, an all-in-one plugin and a Claude Code
-  `marketplace.json` (checked with `claude plugin validate`).
-- New `maggie deployment bridge-plan|bridge-collect-script|bridge-check` for a
-  multi-tenant assistant bridge host on a VPS.
-- `maggie feedback session-summary` reads several repositories
-  (`--repo app=../app --since-date …`) and classifies plain commit subjects.
-- MaggieDash 0.2.12 upstreams generic fixes from the ORA host.
+This package is `0.7.54`. It closes feedback batch 30: 13 records
+from a content and social product that runs MaggieDash on its own website,
+plus MaggieDash 0.2.14.
+
+- **MaggieDash installs the core first.** `maggie dash install` now installs
+  only the dashboard, sign-in, the `/_maggie/admin` route and the core schema.
+  It then reads your project (framework, existing sign-in, database, payments,
+  whether you sell services or run a blog, languages) and recommends optional
+  modules, each with a reason. Nothing optional is installed until you ask:
+  `maggie dash add booking --confirm` (or `maggie booking install`). A content
+  site no longer gets Stripe, booking routes and a worker it never asked for.
+  `maggie dash recommend` repeats the analysis at any time.
+- **MaggieDash 0.2.14 keeps secrets out of the build.** The Astro scaffold
+  read server settings through `import.meta.env`, which Vite writes into the
+  build output: an `astro build` with `DATABASE_URL` or `BOOKING_TOKEN_SECRET`
+  in the environment put them into `dist/server`. They are now read at run
+  time. Rebuild any host installed from an earlier scaffold. The admin
+  sidebar shows only the panels your host serves (capability manifest), and
+  the Booking env example now reaches installs from GitHub.
+- **Nothing client-specific in your agent folders.** Earlier packages
+  installed one client's integration audit, progress logs and a delivery
+  board into `~/.claude/references` and `~/.codex/references`. Only general
+  Booking documents ship now. A release gate fails packaging when a packaged
+  file names a client or links to an unshipped document. `maggie update`
+  removes files an older package installed and this one no longer ships
+  (only when you have not changed them), and `maggie doctor --scope user`
+  reports any that are left.
+- **Feedback always arrives.** `maggie feedback submit` needs no
+  `--endpoint`. It tries the NoBlox host first and, only when that host fails
+  before storing the draft (no connection or a 5xx such as 526), sends it to
+  `feedback.cmo.so`. Both hosts drop duplicates by `feedbackId`.
+- **Social posts.**
+  - `link-check` (and `plan --check-link`) drops articles whose link is gone
+    (404 or 410) before posts are planned. Blocked or failing pages are kept.
+  - `pictures` makes posts written together for several channels share one
+    picture.
+- **Blog API Pull.** `maggie blog live-urls` records where a delivered post
+  went live, from the site's own report or a sitemap match. Matching only
+  adds URLs, never retires earlier matches, and prefers the original page
+  over translated copies.
+- **Generated pages.**
+  - `maggie design bulk` runs many similar pages from one brief, facts file
+    and validator. Pictures are drawn only for validated pages that have not
+    changed since. A writer must re-read a page that changed. Tightened rules
+    send earlier passes back for validation. Nothing is seeded until every
+    page passes.
+  - `maggie localization key-check` finds texts that need per-page position
+    keys instead of site-wide text keys.
+  - `maggie localization fragments` finds sentences split around a brand
+    name into pieces too short to translate.
+- **Pictures.** `maggie media generate --engine codex|gemini` draws a picture,
+  and `maggie media engine-plan` states the time and cost of each engine
+  before a large run (for example, 2400x1000 becomes 21:9 at 2K on Gemini).
+- **Apps.**
+  - `maggie design sheet-check` catches the iOS freeze: closing a sheet and,
+    in the same moment, showing a toast, refreshing, navigating or opening
+    another sheet.
+  - `maggie mobile ota-guard` publishes an update only to a runtime an
+    installed build has. In pnpm monorepos the fingerprint can move with
+    unrelated dependency changes.
+- **Releases.**
+  - `maggie deployment preview-auth-check` finds workflows and webhooks that
+    still post to a preview host you protected with a password.
+  - `maggie product published` waits until a staged npm version is really
+    `latest`.
+
+0.7.53 closed feedback batch 29 (56 records from a booking marketplace and a
+social/assistant product): booking rules with shared test vectors, Stripe
+Connect platform guidance and `connect-qa`, MaggieDash 0.2.13 booking fixes,
+`cloudflare-preflight`, `vps-release`, `qa fit-check`, `mobile ota
+--build-ref`, assistant registry cards and standing approvals, own-domain
+social sources and `seo origin-check`.
+
+0.7.52 added mobile follow-ups: `eas update --environment`, a fingerprint gate,
+and `maggie design safe-area-check`. 0.7.51 (batch 28) added
+`maggie design app-collect`, `maggie qa app-preflight`, and the
+[`maggie-mobile-app`](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/skills/maggie-mobile-app/SKILL.md) and
+[`maggie-assistant-tools`](https://github.com/TOPY-AI-LTD/ai-cmo-skills/blob/main/skills/maggie-assistant-tools/SKILL.md) skills.
+It also added `maggie product`, `maggie skills` and
+`maggie deployment bridge-*`.
 
 The 0.7.50 release made `maggie update` idempotent: files whose content already
 matches the package are left untouched (timestamps included) and counted as
@@ -207,7 +235,7 @@ contract/CLI sync with escaped `arrivalNote` rendering:
 - Feedback: an `improvement` type (hosted as `feature` + `subtype`) and
   `maggie feedback session-summary`.
 - MaggieDash 0.2.11 holds outbox emails whose template is not yet deployed
-  instead of dead-lettering them, and upstreams generic fixes from the ORA host.
+  instead of dead-lettering them, and upstreams generic fixes from a client host.
 
 The 0.7.47 release remains included: project
 initialization creates the repository's Maggie Memory store, memory context
@@ -228,7 +256,7 @@ It also includes the 0.7.45 one-time user-scope installation for
 Codex and Claude Code, a bundled workflow runner, and scoped maintenance
 commands. It also closes the 2026-09-24 booking feedback
 batch with the canonical MaggieDash Calendar availability grid/free-slot
-entry and documented ORA modal focus-restoration evidence. It also adds the
+entry and documented host modal focus-restoration evidence. It also adds the
 secret-free Starter marketplace
 provisioning plan and bundles versioned GitHub repository, Cloudflare Pages,
 Starter site, and Starter release contracts. `maggie marketplace plan` emits a
@@ -787,8 +815,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.52 update --scope project --project . --force
-npx @topy-ai/maggie@0.7.52 cleanup --scope project --project .
+npx @topy-ai/maggie@0.7.54 update --scope project --project . --force
+npx @topy-ai/maggie@0.7.54 cleanup --scope project --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -877,8 +905,10 @@ maggie dash status --project .
 maggie doctor --project .
 ```
 
-`maggie dash install` installs the first-party private MaggieDash dashboard
-source into `./_maggie/admin`, preserving local files unless `--force` is used.
+`maggie dash install` installs the MaggieDash core (dashboard source in
+`./_maggie/admin`, sign-in, the `/_maggie/admin` route and the core schema),
+preserving local files unless `--force` is used, and prints recommendations for
+optional modules. Add one only when wanted: `maggie dash add booking --confirm`.
 It records the resolved source revision in `.maggie/dash-install.json`. During
 bootstrap this is enabled by default; use `--dash-source /path/to/MaggieDash`
 for local development or a configured private Git URL. The host project keeps
@@ -1060,10 +1090,13 @@ maggie feedback collect --project . \
   --actual "Hero is wider than the viewport" \
   --error-fingerprint css-layout-overflow
 maggie feedback preview .maggie/feedback/<feedback-id>.json --format markdown
-maggie feedback submit .maggie/feedback/<feedback-id>.json \
-  --endpoint https://feedback.noblox.app/api/feedback --confirm
+maggie feedback submit .maggie/feedback/<feedback-id>.json --confirm
 ```
 
+Without `--endpoint` the draft goes to the NoBlox host and, only if that host
+fails before storing it (no connection or a 5xx), to `feedback.cmo.so`; both
+drop duplicates by `feedbackId`.
+
 For related observations, create 1–50 local drafts with shared correlation
 metadata and review them before submitting:
 

package/bin/maggie.js

@@ -43,7 +43,7 @@ function loadSkillNames() {
     // Local regression tests may invoke the wrapper before package assembly.
     // Discover real frontmatter directories and never resurrect retired content.
     return readdirSync(SKILLS_ROOT, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory() && entry.name !== "maggie-emdash" && existsSync(join(SKILLS_ROOT, entry.name, "SKILL.md")))
+      .filter((entry) => entry.isDirectory() && existsSync(join(SKILLS_ROOT, entry.name, "SKILL.md")))
       .map((entry) => entry.name).sort();
   }
 }
@@ -85,6 +85,7 @@ Usage:
   maggie bootstrap interview [project]
   maggie dash init|install|status|migrate|transition|variant|cms --project PATH [options]
   maggie booking install|worker-schedule|inspect|setup|contract|runtime-validate|ops-validate|release-gate|stripe-audit|tasks --project PATH [options]
+  maggie booking rules-vectors [--rule ID] [--host-command CMD] | connect-qa [--detect]
   maggie dash sections <validate|prompt|keys|remap-translations|fanout-validate|locale-validate|variant-copy-validate|media-validate|bindings-validate|idempotency-validate|reconcile> [options]
   maggie dash inventory --pages-file FILE [--require-page-kinds] [--require-source-coverage]
   maggie dash api-contract --spec FILE
@@ -99,9 +100,11 @@ Usage:
   maggie dash structure-validate --model FILE --evidence FILE
   maggie design progressive-check|css-check|css-cascade-check|style-check --evidence FILE
   maggie design dash-init|dash-validate|sample-init|sample-validate [options]
-  maggie design pressable-check|layer-check|safe-area-check --project PATH
+  maggie design pressable-check|layer-check|safe-area-check|textinput-check|sheet-check --project PATH
   maggie design palette generate --canvas HEX --text HEX --accent HEX | palette validate --palette FILE
   maggie seo privacy-check --evidence FILE
+  maggie seo origin-check --base-url URL [--project PATH] [--expect-host HOST]
+  maggie seo fragment-check --url URL [--url URL2] [--cookie-env NAME]
   maggie content FILE --source PROVIDER --project PATH --confirm
   maggie agent-content write --url URL --allowed-origin ORIGIN --token-env ENV --payload FILE
   maggie bootstrap phase <start|pass|fail|status> <phase> [project]
@@ -141,7 +144,7 @@ Usage:
   maggie design step <job-id> --step NAME --evidence FILE
   maggie auth reference --project PATH --confirm
   maggie auth check --project PATH [--production]
-  maggie blog init|inspect|ingest|validate|check-gate|approve|publish|sitemap|settings|rollback|integration-state
+  maggie blog init|inspect|ingest|validate|check-gate|approve|publish|sitemap|settings|rollback|integration-state|live-urls
   maggie design status <job-id>
   maggie service import <provider-url> --project PATH
   maggie service sync <provider-url> --project PATH
@@ -153,6 +156,7 @@ Usage:
   maggie service validate --project PATH
   maggie service inspect --project PATH
   maggie service status --project PATH
+  maggie service migrate-check --timezone Europe/London [--clients F] [--appointments F] [--gift-cards F] [--service NAME] [--staff NAME]
   maggie service orchestration-validate --project PATH --manifest FILE
   maggie service import-stages-validate --project PATH --manifest FILE
   maggie service import-readiness --project PATH [--python-module M] [--browser] [--webdriver] [--env NAME] [--country LABEL]
@@ -164,11 +168,19 @@ Usage:
   maggie deployment secret-parity --manifest api-1.json --manifest api-2.json --required KEY
   maggie deployment bridge-plan|bridge-collect-script --plan bridge-host.json
   maggie deployment bridge-check --plan bridge-host.json --observed observed.json
-  maggie mobile preflight|plan --project PATH [--app-dir apps/app] [--profile production] [--platform ios|android|all] [--auto-submit]
+  maggie deployment cloudflare-preflight --project PATH [--env production] [--env-file .env] [--verify-zone]
+  maggie deployment file-parity --host H [--host H2] --root /srv/app/current --path dist/x.mjs [--ref DEPLOYED_COMMIT]
+  maggie deployment warm-check --url URL [--warm 3] [--samples 5] [--budget-ms 800]
+  maggie deployment preview-auth-check --host preview.example.com [--repo PATH] [--live]
+  maggie deployment vps-release --host deploy@HOST --release-root /srv/app --service app --env-file /etc/app.env [--health-url URL] [--confirm]
+  maggie mobile preflight|plan --project PATH [--app-dir apps/app] [--profile production] [--platform ios|android|all] [--auto-submit] [--build-ref REF]
+  maggie mobile ota --project PATH --build-ref REF --build-id ID --message TEXT [--confirm]
+  maggie mobile ota-guard --project PATH --platform ios|android --runtimes FILE [--publish --message TEXT --confirm]
   maggie assistant registry-validate|annotations|capability-page|audit-check --registry FILE [--mcp-tools FILE] [--session FILE] [--output FILE]
   maggie assistant approval-selftest
   maggie product release-check --package DIR [--server-json FILE] [--changelog FILE] [--pack]
   maggie product smoke --package DIR | mcp-check --mcp-url URL | review-status --reviews FILE [--chatgpt-plugin FILE]
+  maggie product published --package-name NAME --version X [--wait 600] [--publish-log FILE]
   maggie skills scaffold|validate|package|smoke --root DIR [--out DIR --prefix NAME --owner NAME] [--claude]
   maggie deployment env-isolation --project PATH --production-env .env.production
   maggie deployment readiness --project PATH
@@ -184,7 +196,7 @@ Usage:
   maggie schedule PATH/.maggie/schedule.json --project PATH
   maggie analytics [traffic-audit|release-gate] --project PATH --environment staging
   maggie analytics gsc-readiness --gsc-evidence FILE
-  maggie media [image-policy|video-policy|video-job|video-provider-evidence|video-playback] [--policy/--job/--evidence FILE]
+  maggie media [generate|engine-plan|image-policy|video-policy|video-job|video-provider-evidence|video-playback] [--policy/--job/--evidence FILE]
   maggie provenance --project PATH [--source PATH] [--output FILE]
   maggie scaffold --project PATH --framework astro|nextjs|sveltekit|nuxt|vite-react|vite-vue [--write --confirm]
   maggie brand-kit --manifest FILE | --project PATH --design DESIGN.md [--write --confirm]
@@ -196,7 +208,7 @@ Usage:
   maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary|email-matrix|lifecycle> [options]
   maggie seo performance|images|sitemap|indexnow|social-cards|head-tags [options] (sitemap supports strict validate and agent-files)
   maggie feedback <collect|preview|batch|batch-review|session-summary|submit|list> [options]
-  maggie qa <start|record|summary|export|assertion-audit|cors-preflight|app-preflight> [options]
+  maggie qa <start|record|summary|export|assertion-audit|cors-preflight|app-preflight|fit-check> [options]
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang] [--check-internal-links]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE [--reason-all REASON]
@@ -430,6 +442,34 @@ function syncTree(source, target, force, root = null, managedFiles = {}, stats =
   return changed;
 }
 
+// Files an earlier package installed that this package no longer ships (for
+// example maintainer documents that were removed from the bundle). Delete a
+// file only when it is still exactly what Maggie installed; keep and report
+// anything changed locally or never installed by Maggie.
+function pruneTree(source, target, root, managedFiles = {}, stats = { removed: 0, kept: 0 }, dryRun = false) {
+  if (!existsSync(target)) return stats;
+  for (const entry of readdirSync(target, { withFileTypes: true })) {
+    const sourcePath = join(source, entry.name);
+    const targetPath = join(target, entry.name);
+    if (entry.isDirectory()) {
+      pruneTree(sourcePath, targetPath, root, managedFiles, stats, dryRun);
+      if (!dryRun && !existsSync(sourcePath) && existsSync(targetPath) && !readdirSync(targetPath).length) rmSync(targetPath, { recursive: true });
+      continue;
+    }
+    if (existsSync(sourcePath)) continue;
+    const managedPath = root ? relative(root, targetPath) : targetPath;
+    if (managedFiles[managedPath] && managedFiles[managedPath] === digest(targetPath)) {
+      if (!dryRun) rmSync(targetPath);
+      console.log(`${dryRun ? "stale" : "removed"} ${targetPath} (no longer shipped)`);
+      stats.removed++;
+    } else {
+      console.log(`kept ${targetPath} (not in this package; local or changed file)`);
+      stats.kept++;
+    }
+  }
+  return stats;
+}
+
 function collectManagedFiles(source, target, root, managedFiles, previousManagedFiles = {}) {
   if (!existsSync(source) || !existsSync(target)) return;
   const sourceStat = readdirSync;
@@ -558,7 +598,7 @@ function update(args) {
   const previousManagedFiles = previousManifest.managedFiles && typeof previousManifest.managedFiles === "object" ? previousManifest.managedFiles : {};
   if (!existsSync(SKILLS_ROOT)) throw new Error("bundled skills are missing; run npm pack from the package source");
   let updated = 0;
-  const stats = { unchanged: 0, preserved: 0 };
+  const stats = { unchanged: 0, preserved: 0, removed: 0, kept: 0 };
   const managedRoot = scope === USER_SCOPE ? "/" : root;
   for (const agentRoot of roots) {
     for (const skill of skills) {
@@ -570,7 +610,14 @@ function update(args) {
       }
       updated += syncTree(source, target, force, managedRoot, previousManagedFiles, stats);
     }
-    if (existsSync(REFERENCES_ROOT) && existsSync(join(agentRoot, "references"))) updated += syncTree(REFERENCES_ROOT, join(agentRoot, "references"), force, managedRoot, previousManagedFiles, stats);
+    if (existsSync(REFERENCES_ROOT) && existsSync(join(agentRoot, "references"))) {
+      updated += syncTree(REFERENCES_ROOT, join(agentRoot, "references"), force, managedRoot, previousManagedFiles, stats);
+      pruneTree(REFERENCES_ROOT, join(agentRoot, "references"), managedRoot, previousManagedFiles, stats);
+    }
+    for (const skill of skills) {
+      const target = join(agentRoot, "skills", skill);
+      if (existsSync(target)) pruneTree(join(SKILLS_ROOT, skill), target, managedRoot, previousManagedFiles, stats);
+    }
   }
   if (scope === PROJECT_SCOPE) {
     const tools = join(root, "tools");
@@ -591,7 +638,7 @@ function update(args) {
     ? { scope, version: PACKAGE_VERSION, agents: manifestRoots, skills: updatedUserSkills, skillsByAgent: userSkillInventory(manifestRoots), managedFiles: userManagedFileDigests(manifestRoots, updatedUserSkills, previousManagedFiles), updated_at: new Date().toISOString() }
     : { scope, version: PACKAGE_VERSION, agents: roots.map((item) => item.slice(root.length + 1)), skills: mergedSkillNames(root, skills), managedFiles: managedFileDigests(root, roots, skills, previousManagedFiles), updated_at: new Date().toISOString() };
   writeInstallManifest(root, manifest, scope);
-  console.log(`Maggie ${scope} update complete: ${updated} files changed, ${stats.unchanged} unchanged, ${stats.preserved} preserved`);
+  console.log(`Maggie ${scope} update complete: ${updated} files changed, ${stats.unchanged} unchanged, ${stats.preserved} preserved${stats.removed ? `, ${stats.removed} removed` : ""}${stats.kept ? `, ${stats.kept} unshipped kept` : ""}`);
   if (stats.preserved) console.log("Local files with changes were preserved. Review the output and rerun with --force only when replacement is intended.");
 }
 
@@ -613,10 +660,10 @@ function marketplace(args) {
 function service(args) {
   const root = projectRoot(args);
   const importCommands = ["import-stages-validate", "import-readiness", "fact-provenance"];
-  const scriptName = args[0] === "orchestration-validate" ? "maggie_service_onboarding.py" : importCommands.includes(args[0]) ? "maggie_service_import.py" : "maggie_service_booking.py";
+  const scriptName = args[0] === "orchestration-validate" ? "maggie_service_onboarding.py" : args[0] === "migrate-check" ? "maggie_service_migration.py" : importCommands.includes(args[0]) ? "maggie_service_import.py" : "maggie_service_booking.py";
   const script = toolScript(scriptName, root);
   if (!existsSync(script)) throw new Error(`service booking CLI is missing: ${script}`);
-  const result = spawnSync("python3", [script, ...(scriptName === "maggie_service_onboarding.py" ? args.slice(1) : args)], { stdio: "inherit", cwd: root, env: { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION } });
+  const result = spawnSync("python3", [script, ...(["maggie_service_onboarding.py", "maggie_service_migration.py"].includes(scriptName) ? args.slice(1) : args)], { stdio: "inherit", cwd: root, env: { ...process.env, MAGGIE_VERSION: PACKAGE_VERSION } });
   if (result.error) throw result.error;
   process.exitCode = result.status ?? 1;
 }
@@ -630,7 +677,8 @@ function seo(args) {
   const command = args[0];
   const scripts = { performance: "maggie_performance.py", images: "maggie_images.py", sitemap: "maggie_sitemap.py", indexnow: "maggie_indexnow.py", "social-cards": "maggie_social_cards.py", "head-tags": "maggie_head_tags.py" };
   if (command === "privacy-check") return workflowCli("maggie_contracts.py", ["privacy-check", ...args.slice(1)]);
-  if (!scripts[command]) throw new Error("seo command must be performance, images, sitemap, indexnow, social-cards, head-tags, or privacy-check");
+  if (command === "origin-check" || command === "fragment-check") return workflowCli("maggie_seo_routes.py", args);
+  if (!scripts[command]) throw new Error("seo command must be performance, images, sitemap, indexnow, social-cards, head-tags, privacy-check, origin-check, or fragment-check");
   workflowCli(scripts[command], args.slice(1));
 }
 
@@ -687,6 +735,10 @@ function doctor(args) {
     console.log(`${inventoryState} user-skill-inventory manifest=${expected?.length ?? "unknown"} on-disk=${installedNames.size}${missing.length ? ` missing=${missing.join(",")}` : ""}`);
     console.log(`INFO user-install-manifest=${installManifestPath(root, scope)}`);
     console.log(`INFO installed-skills=${installedNames.size}`);
+    const managedFiles = manifest?.managedFiles && typeof manifest.managedFiles === "object" ? manifest.managedFiles : {};
+    const stale = { removed: 0, kept: 0 };
+    for (const agentRoot of roots) if (existsSync(REFERENCES_ROOT)) pruneTree(REFERENCES_ROOT, join(agentRoot, "references"), "/", managedFiles, stale, true);
+    console.log(`${stale.removed ? "WARN" : stale.kept ? "INFO" : "PASS"} user-references-shipped stale=${stale.removed} unshipped-local=${stale.kept}${stale.removed ? " (run maggie update --scope user to remove)" : ""}`);
     if (inventoryState === "INCOMPLETE") process.exitCode = 1;
     return;
   }
@@ -785,12 +837,14 @@ try {
   else if (command === "design" && args[0] === "markup-check") workflowCli("maggie_design.py", args);
   else if (command === "design") workflowCli("maggie_design.py", args);
   else if (command === "auth") workflowCli("maggie_auth.py", args);
+  else if (command === "blog" && args[0] === "live-urls") workflowCli("maggie_live_urls.py", args.slice(1));
   else if (command === "blog") workflowCli("maggie_blog.py", args);
   else if (command === "service") service(args);
   else if (command === "docs") docs(args);
   else if (command === "seo") seo(args);
   else if (command === "ops") workflowCli("maggie_ops.py", args);
   else if (command === "deployment" && ["bridge-plan", "bridge-collect-script", "bridge-check"].includes(args[0])) workflowCli("maggie_bridge_host.py", args);
+  else if (command === "deployment" && ["cloudflare-preflight", "file-parity", "warm-check", "vps-release", "preview-auth-check"].includes(args[0])) workflowCli("maggie_deployment_ops.py", args);
   else if (command === "mobile") workflowCli("maggie_mobile.py", args);
   else if (command === "assistant") workflowCli("maggie_assistant_tools.py", args);
   else if (command === "product") workflowCli("maggie_product_release.py", args);
@@ -806,6 +860,7 @@ try {
   else if (command === "migration") workflowCli("maggie_migration.py", args);
   else if (command === "schedule") workflowCli("maggie_schedule.py", args);
   else if (command === "analytics") workflowCli("maggie_analytics.py", args);
+  else if (command === "media" && ["generate", "engine-plan"].includes(args[0])) workflowCli("maggie_media_generate.py", args);
   else if (["media", "provenance", "scaffold", "brand-kit", "npm11", "booking-delivery"].includes(command)) {
     const workflowArgs = command === "media" ? ["media", ...args] : command === "brand-kit" ? ["brand-kit", ...args] : command === "npm11" ? ["npm11", ...args] : command === "booking-delivery" ? ["booking-delivery", ...args] : [command, ...args];
     workflowCli("maggie_workflows.py", workflowArgs);