@topy-ai/maggie 0.7.54 → 0.7.56

package/bundled-contracts/maggie-security/findings-set-example-v1.json

@@ -0,0 +1,148 @@
+{
+  "schema": "maggie-security-findings.v1",
+  "run": {
+    "id": "2026-10-24T06:17:03Z-deps-3f9a",
+    "command": "deps",
+    "maggie_version": "0.7.55",
+    "started_at": "2026-10-24T06:17:41Z",
+    "finished_at": "2026-10-24T06:17:41Z",
+    "site": "example-site",
+    "inputs": {
+      "lockfile": "package-lock.json"
+    },
+    "sources": [
+      {
+        "id": "osv-api",
+        "status": "ok",
+        "fetched_at": "2026-10-24T06:17:09Z"
+      }
+    ],
+    "tools": [
+      {
+        "name": "osv-scanner",
+        "version": "2.2.3",
+        "sha256": null
+      }
+    ],
+    "degraded": [],
+    "refused": [],
+    "covered": [
+      "pkg:npm/next"
+    ]
+  },
+  "summary": {
+    "new": 1,
+    "open": 0,
+    "fixed": 0,
+    "by_severity": {
+      "critical": 1,
+      "high": 0,
+      "medium": 0,
+      "low": 0,
+      "info": 0
+    },
+    "by_priority": {
+      "p0": 1,
+      "p1": 0,
+      "p2": 0,
+      "p3": 0,
+      "p4": 0
+    }
+  },
+  "clipped": {
+    "findings": false,
+    "total": 1
+  },
+  "findings": [
+    {
+      "schema": "maggie-security-finding.v1",
+      "id": "msf_a6f3541c959e767b53b29ad6",
+      "kind": "vulnerability",
+      "title": "next 14.2.10: authorization bypass in middleware",
+      "severity": "critical",
+      "severity_source": "cvss",
+      "priority": "p0",
+      "confidence": "likely",
+      "aliases": [
+        "CVE-2025-29927",
+        "GHSA-f82v-jwr5-mffw"
+      ],
+      "cvss": {
+        "version": "3.1",
+        "score": 9.1,
+        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+      },
+      "epss": {
+        "score": 0.93,
+        "percentile": 0.99,
+        "date": "2026-10-23"
+      },
+      "kev": {
+        "listed": true,
+        "date_added": "2025-04-02",
+        "ransomware": "unknown"
+      },
+      "cwe_ids": [
+        "CWE-285"
+      ],
+      "asvs_ids": [
+        "V8.2.1"
+      ],
+      "affected": {
+        "purl": "pkg:npm/next@14.2.10",
+        "ecosystem": "npm",
+        "name": "next",
+        "version": "14.2.10",
+        "component_type": "library",
+        "direct": true,
+        "scope": "runtime"
+      },
+      "fix": {
+        "fixed_versions": [
+          "14.2.25"
+        ],
+        "recommended": "14.2.25",
+        "available": true
+      },
+      "target": {
+        "site": "example-site",
+        "host": null,
+        "url": null,
+        "path": "package-lock.json",
+        "image": null
+      },
+      "evidence": [
+        {
+          "path": "package-lock.json",
+          "line": 812,
+          "excerpt": "\"next\": \"14.2.10\""
+        }
+      ],
+      "source": {
+        "command": "deps",
+        "tool": "osv-scanner",
+        "tool_version": "2.2.3",
+        "rule_id": "GHSA-f82v-jwr5-mffw",
+        "feed": "osv",
+        "fetched_at": "2026-10-24T06:17:09Z"
+      },
+      "remediation": {
+        "summary": "Upgrade next to 14.2.25 or later.",
+        "steps": [
+          "npm install next@14.2.25",
+          "rebuild and redeploy"
+        ],
+        "snippets": [],
+        "references": [
+          "https://osv.dev/vulnerability/GHSA-f82v-jwr5-mffw"
+        ],
+        "cheat_sheet": null
+      },
+      "signal": null,
+      "status": "new",
+      "first_seen": "2026-10-24T06:17:41Z",
+      "last_seen": "2026-10-24T06:17:41Z"
+    }
+  ],
+  "fixed": []
+}

package/bundled-contracts/maggie-security/findings-set-v1.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-security/findings-set-v1.json",
+  "title": "Maggie security findings set",
+  "description": "One run of a maggie security command. findings[] items follow finding-v1.schema.json.",
+  "type": "object",
+  "required": ["schema", "run", "summary", "clipped", "findings"],
+  "properties": {
+    "schema": {"const": "maggie-security-findings.v1"},
+    "run": {"type": "object", "required": ["id", "command", "started_at", "finished_at", "sources", "tools", "degraded", "refused"], "properties": {
+      "id": {"type": "string"}, "command": {"type": "string"}, "maggie_version": {"type": "string"},
+      "started_at": {"type": "string"}, "finished_at": {"type": "string"}, "site": {"type": ["string", "null"]},
+      "inputs": {"type": "object"},
+      "sources": {"type": "array", "items": {"type": "object", "required": ["id", "status"], "properties": {
+        "id": {"type": "string"}, "status": {"enum": ["ok", "cached", "degraded", "skipped"]}, "fetched_at": {"type": ["string", "null"]},
+        "version": {"type": ["string", "null"]}, "cursor": {"type": ["string", "null"]}, "error": {"type": ["string", "null"]}
+      }}},
+      "tools": {"type": "array", "items": {"type": "object", "required": ["name"], "properties": {"name": {"type": "string"}, "version": {"type": ["string", "null"]}, "sha256": {"type": ["string", "null"]}}}},
+      "degraded": {"type": "array", "items": {"type": "string"}},
+      "refused": {"type": "array", "items": {"type": "string"}},
+      "covered": {"type": "array", "items": {"type": "string"}, "description": "Targets this run fully covered; the ledger only marks findings on these targets fixed."}
+    }},
+    "summary": {"type": "object", "required": ["new", "open", "fixed", "by_severity"], "properties": {
+      "new": {"type": "integer"}, "open": {"type": "integer"}, "fixed": {"type": "integer"},
+      "by_severity": {"type": "object", "properties": {"critical": {"type": "integer"}, "high": {"type": "integer"}, "medium": {"type": "integer"}, "low": {"type": "integer"}, "info": {"type": "integer"}}},
+      "by_priority": {"type": "object"}
+    }},
+    "clipped": {"type": "object", "required": ["findings", "total"], "properties": {"findings": {"type": "boolean"}, "total": {"type": "integer"}}},
+    "findings": {"type": "array", "items": {"type": "object"}},
+    "fixed": {"type": "array", "items": {"type": "string"}, "description": "Finding ids the ledger marked fixed in this run."}
+  }
+}

package/bundled-contracts/maggie-security/protect-plan-v1.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-security/protect-plan-v1.json",
+  "title": "Maggie security protection plan",
+  "description": "A reviewed, never auto-applied plan from `maggie security protect-plan`. See docs/maggie-security/05-protection-waf-prd.md section 6.2.",
+  "type": "object",
+  "required": ["schema", "id", "host", "created_at", "engine", "egress", "data_sharing", "requires", "risk_notes", "steps", "verify", "rollback"],
+  "properties": {
+    "schema": {"const": "maggie-security-protect-plan.v1"},
+    "id": {"type": "string", "pattern": "^pp_"},
+    "host": {"type": "string"},
+    "created_at": {"type": "string"},
+    "engine": {"enum": ["crowdsec", "fail2ban", "cloudflare"]},
+    "waf": {"type": "object"},
+    "inputs": {"type": "object"},
+    "egress": {"type": "array", "items": {"type": "object", "required": ["host", "why"]}},
+    "data_sharing": {"type": "object", "required": ["crowdsec_capi", "console"], "properties": {"crowdsec_capi": {"type": "boolean"}, "console": {"const": false}}},
+    "requires": {"type": "object", "required": ["consent"], "properties": {"consent": {"const": "host-change"}}},
+    "risk_notes": {"type": "array", "items": {"type": "string"}},
+    "advice": {"type": "array", "items": {"type": "string"}},
+    "steps": {"type": "array", "items": {"type": "object", "required": ["n", "title", "run", "kind", "reversible"], "properties": {
+      "n": {"type": "integer"}, "title": {"type": "string"}, "run": {"type": "string"}, "kind": {"enum": ["local", "host"]},
+      "reversible": {"type": "boolean"}, "rollback": {"type": "string"}}}},
+    "verify": {"type": "array", "items": {"type": "object", "required": ["check", "expect"]}},
+    "rollback": {"type": "array", "items": {"type": "string"}},
+    "allowlist": {"type": "object"}
+  }
+}

package/bundled-contracts/maggie-security/report-v1.schema.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-security/report-v1.json",
+  "title": "Maggie security report",
+  "description": "Per-site report built by `maggie security report`; references finding ids, full findings stay in .maggie/security/runs/. See docs/maggie-security/09-risk-report-standards-prd.md section 8.2.",
+  "type": "object",
+  "required": ["schema", "id", "site", "kind", "period", "verdict", "counts", "actions", "checked", "degraded_sources", "runs", "findings"],
+  "properties": {
+    "schema": {"const": "maggie-security-report.v1"},
+    "id": {"type": "string"},
+    "site": {"type": "string"},
+    "kind": {"enum": ["weekly", "daily_ops", "incident", "gate"]},
+    "audience": {"enum": ["owner", "technical"]},
+    "period": {"type": "object", "required": ["from", "to"], "properties": {"from": {"type": "string"}, "to": {"type": "string"}}},
+    "verdict": {"type": "object", "required": ["code", "text"], "properties": {"code": {"enum": ["possible-break-in", "act-today", "act-this-week", "nothing-urgent"]}, "text": {"type": "string"}}},
+    "counts": {"type": "object", "required": ["new", "open", "fixed", "by_priority"]},
+    "actions": {"type": "array", "items": {"type": "object", "required": ["finding_id", "priority", "title"]}},
+    "coverage": {"type": ["object", "null"]},
+    "checked": {"type": "array", "items": {"type": "object", "required": ["command", "last_run", "degraded"]}},
+    "not_checked": {"type": "array", "items": {"type": "string"}},
+    "degraded_sources": {"type": "array", "items": {"type": "string"}},
+    "runs": {"type": "array", "items": {"type": "string"}},
+    "findings": {"type": "array", "items": {"type": "string", "pattern": "^msf_[0-9a-f]{24}$"}},
+    "fixed": {"type": "array", "items": {"type": "string"}},
+    "maggie_version": {"type": "string"},
+    "incident": {"type": "object", "required": ["id", "title", "status", "timeline"]},
+    "gate": {"type": "object", "required": ["decision", "block", "warn"], "properties": {"decision": {"enum": ["pass", "warn", "block"]}, "block": {"type": "array"}, "warn": {"type": "array"}, "checked": {"type": "array"}}}
+  }
+}

package/bundled-contracts/maggie-security/stack-example-v1.json

@@ -0,0 +1,66 @@
+{
+  "schema": "maggie-security-stack.v1",
+  "site": {
+    "id": "example-site",
+    "type": "node-app",
+    "domains": [
+      "example.com"
+    ],
+    "hosting": "vps-with-cloudflare-dns"
+  },
+  "collected_at": "2026-10-24T06:00:00Z",
+  "hash": "sha256:73a805dca6155476f3cdc7f91b1954517325abcda06ecbb381d550c4732cc497",
+  "sources": [
+    {
+      "kind": "lockfile",
+      "path": "package-lock.json"
+    },
+    {
+      "kind": "runtime-inventory",
+      "path": ".maggie/security/inventory/host-web1.json"
+    }
+  ],
+  "components": [
+    {
+      "purl": "pkg:npm/next@14.2.10",
+      "ecosystem": "npm",
+      "name": "next",
+      "version": "14.2.10",
+      "scope": "runtime",
+      "direct": true,
+      "location": "package-lock.json"
+    }
+  ],
+  "runtimes": [
+    {
+      "name": "node",
+      "version": "20.11.1",
+      "cycle": "20",
+      "host": "web1",
+      "source": "runtime-inventory"
+    },
+    {
+      "name": "nginx",
+      "version": "1.24.0",
+      "cycle": "1.24",
+      "host": "web1",
+      "source": "runtime-inventory"
+    }
+  ],
+  "wordpress": null,
+  "images": [],
+  "hosts": [
+    {
+      "id": "web1",
+      "os": "ubuntu 22.04",
+      "public": true
+    }
+  ],
+  "watch": {
+    "products": [
+      "nginx",
+      "node",
+      "next"
+    ]
+  }
+}

package/bundled-contracts/maggie-security/stack-upload-v1.schema.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-security/stack-upload-v1.json",
+  "title": "Maggie security stack upload",
+  "description": "What `maggie security inventory --export-upload` sends to CMO.so for the hosted daily watch: package and runtime names and versions only. No file paths, host names, lockfile contents, logs or secrets. See docs/maggie-security/11-mcp-tools-prd.md section 9.",
+  "type": "object",
+  "required": ["schema", "workspace", "site_type", "created_at", "hash", "components", "runtimes"],
+  "additionalProperties": false,
+  "properties": {
+    "schema": {"const": "maggie-security-stack-upload.v1"},
+    "workspace": {"type": "string", "maxLength": 253},
+    "site_type": {"type": "string"},
+    "created_at": {"type": "string"},
+    "hash": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
+    "components": {"type": "array", "maxItems": 20000, "items": {"type": "object", "required": ["ecosystem", "name", "version"], "additionalProperties": false,
+      "properties": {"ecosystem": {"type": "string"}, "name": {"type": "string"}, "version": {"type": "string"}, "scope": {"type": "string"}, "direct": {"type": ["boolean", "null"]}}}},
+    "runtimes": {"type": "array", "items": {"type": "object", "required": ["name", "version"], "additionalProperties": false,
+      "properties": {"name": {"type": "string"}, "version": {"type": "string"}, "host": {"type": ["string", "null"], "description": "opaque alias such as web1, never a hostname"}}}},
+    "wordpress": {"type": ["object", "null"]},
+    "watch": {"type": "array", "items": {"type": "string"}}
+  }
+}

package/bundled-contracts/maggie-security/stack-v1.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-security/stack-v1.json",
+  "title": "Maggie security stack inventory",
+  "description": "What a site actually runs; read by every matcher. See docs/maggie-security/00-foundation-prd.md section 8.",
+  "type": "object",
+  "required": ["schema", "site", "collected_at", "hash", "sources", "components", "runtimes"],
+  "properties": {
+    "schema": {"const": "maggie-security-stack.v1"},
+    "site": {"type": "object", "required": ["id"], "properties": {
+      "id": {"type": "string"}, "type": {"enum": ["static", "wordpress", "node-app", "php-app", "python-app", "java-app", "go-app", "ruby-app", "dotnet-app", "astro", "workers", "unknown"]},
+      "domains": {"type": "array", "items": {"type": "string"}}, "hosting": {"type": ["string", "null"]}
+    }},
+    "collected_at": {"type": "string"},
+    "hash": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
+    "sources": {"type": "array", "items": {"type": "object", "required": ["kind", "path"], "properties": {
+      "kind": {"enum": ["lockfile", "manifest", "runtime-inventory", "wordpress", "sbom", "manual"]}, "path": {"type": "string"}
+    }}},
+    "components": {"type": "array", "items": {"type": "object", "required": ["ecosystem", "name", "version"], "properties": {
+      "purl": {"type": ["string", "null"]}, "ecosystem": {"type": "string"}, "name": {"type": "string"}, "version": {"type": "string"},
+      "scope": {"enum": ["runtime", "dev", "build", "os", "service"]}, "direct": {"type": ["boolean", "null"]}, "location": {"type": ["string", "null"]},
+      "host": {"type": ["string", "null"], "description": "host alias for OS packages"}
+    }}},
+    "runtimes": {"type": "array", "items": {"type": "object", "required": ["name", "version"], "properties": {
+      "name": {"type": "string"}, "version": {"type": "string"}, "cycle": {"type": ["string", "null"]},
+      "host": {"type": ["string", "null"]}, "source": {"type": ["string", "null"]}, "site_root": {"type": ["string", "null"]}
+    }}},
+    "wordpress": {"type": ["object", "null"], "properties": {
+      "core": {"type": ["string", "null"]},
+      "plugins": {"type": "array", "items": {"type": "object", "required": ["slug"], "properties": {"slug": {"type": "string"}, "version": {"type": ["string", "null"]}, "active": {"type": ["boolean", "null"]}}}},
+      "themes": {"type": "array", "items": {"type": "object", "required": ["slug"], "properties": {"slug": {"type": "string"}, "version": {"type": ["string", "null"]}, "active": {"type": ["boolean", "null"]}}}}
+    }},
+    "images": {"type": "array", "items": {"type": "object", "required": ["ref"], "properties": {"ref": {"type": "string"}, "digest": {"type": ["string", "null"]}, "host": {"type": ["string", "null"]}}}},
+    "hosts": {"type": "array", "items": {"type": "object", "required": ["id"], "properties": {"id": {"type": "string"}, "os": {"type": ["string", "null"]}, "public": {"type": ["boolean", "null"]}}}},
+    "watch": {"type": "object", "properties": {"products": {"type": "array", "items": {"type": "string"}}}}
+  }
+}

package/bundled-contracts/maggie-security/tools-lock-v1.schema.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/maggie-security/tools-lock-v1.json",
+  "title": "Maggie security external tool lock",
+  "description": "Pinned external scanners: version, licence class, per-platform asset URL and sha256, required and forbidden flags. See docs/maggie-security/00-foundation-prd.md section 11.",
+  "type": "object",
+  "required": ["schema", "tools"],
+  "properties": {
+    "schema": {"const": "maggie-security-tools-lock.v1"},
+    "updated": {"type": "string"},
+    "tools": {"type": "object", "additionalProperties": {"$ref": "#/$defs/tool"}}
+  },
+  "$defs": {
+    "tool": {
+      "type": "object",
+      "required": ["version", "licence", "class"],
+      "properties": {
+        "version": {"type": "string"},
+        "licence": {"type": "string"},
+        "class": {"enum": ["bundle-ok", "external-only", "reference-only"]},
+        "homepage": {"type": "string"},
+        "binary": {"type": "string", "description": "Executable name inside the asset (defaults to the tool name)."},
+        "version_args": {"type": "array", "items": {"type": "string"}},
+        "assets": {"type": "object", "additionalProperties": {"type": "object", "required": ["url", "sha256"], "properties": {
+          "url": {"type": "string", "pattern": "^https://"}, "sha256": {"type": "string", "pattern": "^([0-9a-f]{64}|UNPINNED)$"},
+          "archive": {"enum": ["none", "tar.gz", "zip"]}, "member": {"type": "string"}
+        }}},
+        "required_flags": {"type": "array", "items": {"type": "string"}},
+        "flags_after_subcommand": {"type": "boolean", "description": "Insert required flags after the first argument (the tool's subcommand)."},
+        "forbidden_flags": {"type": "array", "items": {"type": "string"}},
+        "env": {"type": "object", "additionalProperties": {"type": "string"}},
+        "notes": {"type": "string"}
+      }
+    }
+  }
+}

package/bundled-skills/catalog.json

@@ -4,7 +4,7 @@
   "skills": [
     {
       "name": "maggie-assistant-tools",
-      "description": "Build an AI assistant's tools once and expose them safely to an in-app agent, an MCP server and ChatGPT/Claude apps. Use for tool registries, risk levels and gates, result cards, approval cards with signed one-time tokens and standing workflow approvals, audit logs, MCP annotations, public discovery MCP and audience binding, visitor-facing receptionists, user-facing capability pages, publishing product CLI/MCP packages and app reviews, and multi-tenant assistant bridge hosts."
+      "description": "Build an AI assistant's tools once and expose them safely to an in-app agent, an MCP server and ChatGPT/Claude apps. Use for tool registries, risk levels and gates, result cards, approval cards with signed one-time tokens and standing workflow approvals, audit logs, report inboxes and server-enforced limits for scheduled agents (agent keys, sign-in grants, clipped lists), MCP annotations, public discovery MCP and audience binding, visitor-facing receptionists, user-facing capability pages, publishing product CLI/MCP packages and app reviews, and multi-tenant assistant bridge hosts."
     },
     {
       "name": "maggie-auth-reference",
@@ -74,6 +74,10 @@
       "name": "maggie-qa-workflow",
       "description": "Run scenario-based browser QA with explicit evidence, fix/retest lifecycle, and release-gate decisions for web projects."
     },
+    {
+      "name": "maggie-security",
+      "description": "Check and monitor the security of a Maggie website and the stack it runs on — new CVEs and advisories for its packages (npm, Composer, PyPI, Maven, Go, RubyGems, crates, NuGet), runtimes (Node, PHP, Python, Java, Go, Ruby, .NET), databases (MySQL, MariaDB, PostgreSQL, Redis, MongoDB), web servers, Linux distributions and WordPress core/plugins/themes, end-of-life dates, CISA KEV and EPSS, CVE response plans, and plain-language security reports. Use when the user asks \"is my site secure\", \"are we affected by CVE-…\", \"is this package/plugin safe\", \"is our PHP/MySQL/Ubuntu still supported\", \"security report\", or wants daily security monitoring. Never scans domains the user has not verified; never changes a server."
+    },
     {
       "name": "maggie-seo-geo",
       "description": "Plan, audit, create, rewrite, and measure content for AI CMO's paid SEO and GEO workflow. Use for topic opportunities, AI visibility, technical SEO, extractable article structure, sitemap-based rewrites, GSC readback, or SEO/GEO client reports."

package/bundled-skills/maggie-assistant-tools/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: maggie-assistant-tools
-description: Build an AI assistant's tools once and expose them safely to an in-app agent, an MCP server and ChatGPT/Claude apps. Use for tool registries, risk levels and gates, result cards, approval cards with signed one-time tokens and standing workflow approvals, audit logs, MCP annotations, public discovery MCP and audience binding, visitor-facing receptionists, user-facing capability pages, publishing product CLI/MCP packages and app reviews, and multi-tenant assistant bridge hosts.
+description: Build an AI assistant's tools once and expose them safely to an in-app agent, an MCP server and ChatGPT/Claude apps. Use for tool registries, risk levels and gates, result cards, approval cards with signed one-time tokens and standing workflow approvals, audit logs, report inboxes and server-enforced limits for scheduled agents (agent keys, sign-in grants, clipped lists), MCP annotations, public discovery MCP and audience binding, visitor-facing receptionists, user-facing capability pages, publishing product CLI/MCP packages and app reviews, and multi-tenant assistant bridge hosts.
 metadata:
   version: 1.0.0
 ---
@@ -119,6 +119,37 @@ maggie assistant approval-selftest
 maggie assistant audit-check --registry tools.registry.json --session recorded-session.json
 ```
 
+## Unattended agents: report inbox, server caps, sign-in defaults
+
+Scheduled routines (Claude Routines, Codex Automations, cloud tasks) call the
+MCP with nobody watching. Read [unattended agents](references/unattended-agents.md)
+and [report inbox](references/report-inbox.md) before exposing tools to them.
+The registry declares, and `registry-validate` checks:
+
+- `reportInbox` — `report_save` (write-reversible, changes nothing else),
+  `reports_list`, `report_get`; a per-website daily cap, size limits,
+  retention, and agent-written title/summary/body returned as untrusted.
+  Every routine ends its run with a report
+  ([report schema](../../bundled-contracts/maggie-assistant-tools/report-v1.schema.json);
+  check one with `maggie assistant report-check`).
+- `unattended.enforcedBy: "server"` — a prompt is not a limit. Agent keys
+  run only the writes their standing permission names, each with `perDay`;
+  they cannot confirm previews and a refused write returns the reason.
+  Every write a sign-in (OAuth) grant can reach needs `perToolPerDay` or a
+  `dailyWriteLimit` the server counts per grant.
+- `unattended.oauth.defaultTools: "role"` — a sign-in connection gets the
+  role's full MCP tool set by default; a narrower default needs
+  `narrowedReason` (a default copied from one feature, such as translation
+  tools only, cuts routines off from the rest of the product).
+- `clips` on a list tool that shortens fields — each shortened item carries
+  `clipped`, and `getTool` returns the full text on the same channels. Check a
+  recorded result with `maggie assistant list-check`.
+
+```bash
+maggie assistant list-check --registry tools.registry.json --tool social_list --result recorded-list.json
+maggie assistant report-check --report report.json --registry tools.registry.json
+```
+
 ## Publishing product CLIs and MCP servers
 
 See [product release](references/product-release.md):
@@ -140,5 +171,7 @@ See [bridge host](references/bridge-host.md) and
 - Never let the model see or choose an approval token; never accept a write
   without one (or a standing approval whose limits cover the call).
 - Never expose `never` tools or billing changes on MCP or third-party apps.
+- Never rely on a routine's prompt to limit what an unattended caller writes;
+  the server counts every cap.
 - Never publish a package or submit an app for review without an explicit
   yes; these commands only check.

package/bundled-skills/maggie-assistant-tools/references/report-inbox.md

@@ -0,0 +1,45 @@
+# Report inbox
+
+Scheduled agents and the server's own daily jobs need one place to leave
+their results. Without it, a routine's findings exist only in its own run
+transcript and the person never sees them in the product.
+
+## Shape
+
+Three tools, declared in `registry.reportInbox`:
+
+| Tool (example name) | Risk | Does |
+|---|---|---|
+| `report_save` | write-reversible | saves one report; changes nothing else, so a standing permission may cover it |
+| `reports_list` | read | newest first, title and one-line summary each, unread count; filter by kind / unread |
+| `report_get` | read | one report in full (Markdown body, optional data); marks it read |
+
+A report has a `title` (≤ 120 characters), a `summary` of one or two
+sentences (≤ 500) shown in the inbox and the push, a Markdown `body_md`
+(≤ 50,000), optional `data`, a `kind` (`weekly`, `daily_ops`, `agent`,
+`post_health`, …) and a `source` the server sets (`system:<job>` or
+`agent:<key or grant id>`), never the caller.
+
+## Rules
+
+- **Capped per website per day** (`perSitePerDay`, for example 20 agent
+  reports), counted by the server; body size limited.
+- **Untrusted when read back.** An agent wrote the title, summary and body,
+  so `reports_list` and `report_get` return them under the product's
+  untrusted marker and readers treat them as data, never instructions
+  (`untrusted: ["title", "summary", "body"]`).
+- **Seen where people look.** The newest unread report appears in the app's
+  inbox and is pushed (a push type the person can switch off).
+- **Kept for a set time** (`retentionDays`, for example 180).
+- **Every routine ends with `report_save`**, including runs that found
+  nothing ("nothing to do today" is a result), and reads `reports_list` first
+  so it does not repeat what another run or a server job already reported.
+
+## Before saving
+
+```bash
+maggie assistant report-check --report report.json --registry tools.registry.json
+```
+
+checks the title, summary and body against the registry's limits and refuses
+anything that looks like a secret.

package/bundled-skills/maggie-assistant-tools/references/unattended-agents.md

@@ -0,0 +1,70 @@
+# Unattended agents: keys, sign-in grants and clipped lists
+
+A scheduled routine (Claude Routines, Codex Automations, a cloud task) calls
+the product's MCP with nobody watching. Three things go wrong when the tool
+surface was designed only for a person in a chat. Each is checked by
+`maggie assistant registry-validate` once the registry declares it.
+
+## 1. A prompt is not a limit
+
+A routine's prompt can say "add at most ten ideas a day", but nothing stops
+the next run, a changed prompt, or a confused model from doing more. Every
+write an unattended caller can reach needs a cap the **server** counts.
+
+Declare it in `registry.unattended` (`enforcedBy: "server"`):
+
+- **Agent keys** (`agentKeys`): an API key made for one routine holds a
+  standing permission naming the writes it may run without a preview and a
+  daily number for each (`standingTools.<tool>.perDay`). Before such a write
+  the server claims one use; when the claim is refused (today's number is
+  used, the permission was revoked) the tool returns the reason, not a
+  preview (`refusalReturnsReason: true`) — nobody is there to confirm one, and
+  an agent key can never confirm previews (`canConfirmPreviews: false`).
+  Standing permissions cover reversible or spending writes only; public or
+  irreversible writes always go through a person.
+- **Sign-in (OAuth) grants** (`oauth`): a connector the person signed in with
+  acts as that person, with their full role. Give the grant its own server
+  caps — a total daily write number (`dailyWriteLimit`) and/or one per tool
+  (`perToolPerDay`) — that the owner sets on the connections page, and count
+  them per grant. The validator fails any write a grant can reach with no cap.
+
+Record each claimed use with the key or grant id in the audit log, the same
+way a standing workflow approval is recorded (see
+[approvals and audit](approvals-and-audit.md)).
+
+## 2. The sign-in default is the role's full tool set
+
+A grant's default tool set should be what the person's role allows on MCP,
+filtered at call time by the role (`oauth.defaultTools: "role"`). A default
+copied from the first feature that used sign-in (for example only the
+translation tools) leaves a routine connected by sign-in unable to reach the
+rest of the product, with no error that says why. A narrower default is
+allowed only with `narrowedReason`; the validator names the tools it leaves
+out.
+
+Re-check membership and role on every call, so removing or demoting a person
+cuts their connected apps off at once.
+
+## 3. Clipped list fields need a full-text get tool
+
+List tools keep responses small by shortening long fields (a post's text to
+about 300 characters). An agent asked to check what will be published then
+reports text "cut off mid-sentence" that is in fact whole. For every list
+that shortens fields:
+
+- declare `clips` on the list tool: the shortened `fields`, `maxChars`, the
+  `getTool` that returns one item in full, and the `idField` it takes;
+- mark each shortened item in the result: `clipped: true` or
+  `clipped: ["text"]`;
+- serve the get tool on every channel the list is on, read-only, same scope;
+- say in the list's model-facing description that text is shortened and which
+  tool reads it in full.
+
+Check a recorded result of the list:
+
+```bash
+maggie assistant list-check --registry tools.registry.json --tool social_list --result recorded-list.json
+```
+
+It fails items whose field reaches `maxChars` (or ends with an ellipsis)
+without a `clipped` marker, and items without the id the get tool needs.

package/bundled-skills/maggie-blog/SKILL.md

@@ -60,10 +60,17 @@ API Pull deliveries need their live URL recorded so social posts and internal
 links point at the page that exists now: the site reports it on publish
 (`maggie blog live-urls record --content-id ID --url URL`), and
 `maggie blog live-urls match --sitemap URL --write` fills the gaps
-additively — it never retires an earlier match, and the original page wins
-over translated copies that share the slug. See
+additively — it never retires an earlier match, a post tracked with an empty
+URL is still matched, and the original page wins over translated copies that
+share the slug. See
 [where a delivered post went live](../../bundled-tools/integrations/maggie-api-pull.md#where-a-delivered-post-went-live).
 
+A pull site also pulls rewrites (`GET /updates`, same schedule as `/posts`):
+apply each one to the post it is for (`source_content_id`, else slug or
+address, previous slugs too), change only the body, keep the replaced body for
+undo, hold `publication_status: draft` rewrites and never create a post from
+one. See [rewrites on pull sites](../../bundled-tools/integrations/maggie-api-pull.md#rewrites-on-pull-sites).
+
 Automatic publication is an opt-in host policy, not the default. Keep human
 review enabled unless the owner explicitly chooses otherwise. If a host has
 that approval, validate its evidence before its scheduler calls the host's

package/bundled-skills/maggie-booking/SKILL.md

@@ -163,7 +163,7 @@ Use `--schedule systemd` or `--schedule cron` with `--ready` only to generate a
 reviewable scheduler artifact; enabling it remains an operator action after
 backup, migration, and release evidence checks.
 
-The default installer source is MaggieDash `main` (currently `0.2.14`; pin
+The default installer source is MaggieDash `main` (currently `0.2.15`; pin
 another release with `--ref`). It contains the released Astro `hostBootstrap`
 manifest and 47-route Booking source, including the tenant-scoped treatment
 package catalogue, and follows the booking rules above (manage-link state