@topy-ai/maggie 0.7.54 → 0.7.56

package/bundled-tools/clis/security_data/tools.lock.json

@@ -0,0 +1,358 @@
+{
+  "schema": "maggie-security-tools-lock.v1",
+  "updated": "2026-10-24",
+  "tools": {
+    "osv-scanner": {
+      "version": "2.6.0",
+      "licence": "Apache-2.0",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/google/osv-scanner",
+      "version_args": [
+        "--version"
+      ],
+      "assets": {
+        "linux-amd64": {
+          "url": "https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_amd64",
+          "sha256": "ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108",
+          "archive": "none"
+        },
+        "linux-arm64": {
+          "url": "https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_arm64",
+          "sha256": "2c71403eb443d05891c4f268c3ad771cf4f16e5443463fd7851ef8f454d3c7e4",
+          "archive": "none"
+        },
+        "darwin-arm64": {
+          "url": "https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_darwin_arm64",
+          "sha256": "98c460dcd37de25819babd757d04542045b6243113e209edcd4d89fedb0256b4",
+          "archive": "none"
+        },
+        "darwin-amd64": {
+          "url": "https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_darwin_amd64",
+          "sha256": "60c5296637e977b28eeda5c7f13573e447659a632922737f94d11fa7e30ad6ca",
+          "archive": "none"
+        }
+      },
+      "required_flags": [],
+      "forbidden_flags": [
+        "fix",
+        "--experimental-call-analysis"
+      ],
+      "notes": "sha256 from upstream osv-scanner_SHA256SUMS (v2.6.0, published 2026-09-14; v2.7.0 skipped by the 14-day cooldown)."
+    },
+    "gitleaks": {
+      "version": "8.30.1",
+      "licence": "MIT",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/gitleaks/gitleaks",
+      "version_args": [
+        "version"
+      ],
+      "assets": {
+        "linux-amd64": {
+          "url": "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz",
+          "sha256": "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb",
+          "archive": "tar.gz",
+          "member": "gitleaks"
+        },
+        "linux-arm64": {
+          "url": "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_arm64.tar.gz",
+          "sha256": "e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080",
+          "archive": "tar.gz",
+          "member": "gitleaks"
+        },
+        "darwin-arm64": {
+          "url": "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_darwin_arm64.tar.gz",
+          "sha256": "b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5",
+          "archive": "tar.gz",
+          "member": "gitleaks"
+        },
+        "darwin-amd64": {
+          "url": "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_darwin_x64.tar.gz",
+          "sha256": "dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709",
+          "archive": "tar.gz",
+          "member": "gitleaks"
+        }
+      },
+      "required_flags": [
+        "--no-banner",
+        "--redact"
+      ],
+      "forbidden_flags": [],
+      "notes": "sha256 from upstream gitleaks_8.30.1_checksums.txt. --redact keeps values out of its report."
+    },
+    "retire": {
+      "version": "5.3.0",
+      "licence": "Apache-2.0",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/RetireJS/retire.js",
+      "binary": "retire",
+      "version_args": [
+        "--version"
+      ],
+      "required_flags": [],
+      "forbidden_flags": [],
+      "notes": "npm package; run with: npx --yes retire@5.3.0. No standalone binary."
+    },
+    "nuclei": {
+      "version": "3.4.10",
+      "licence": "MIT",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/projectdiscovery/nuclei",
+      "version_args": [
+        "-version"
+      ],
+      "assets": {
+        "linux-amd64": {
+          "url": "https://github.com/projectdiscovery/nuclei/releases/download/v3.4.10/nuclei_3.4.10_linux_amd64.zip",
+          "sha256": "UNPINNED",
+          "archive": "zip",
+          "member": "nuclei"
+        }
+      },
+      "required_flags": [
+        "-ni",
+        "-duc",
+        "-omit-raw",
+        "-silent"
+      ],
+      "forbidden_flags": [
+        "-ai",
+        "-llm",
+        "-dashboard",
+        "-pd",
+        "-pdu",
+        "-auth",
+        "-team-id",
+        "-interactsh-server",
+        "-iserver",
+        "-cloud-upload"
+      ],
+      "notes": "-ni disables OAST (interactsh) traffic to third parties; -duc disables update checks."
+    },
+    "httpx": {
+      "version": "1.7.1",
+      "licence": "MIT",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/projectdiscovery/httpx",
+      "assets": {
+        "linux-amd64": {
+          "url": "https://github.com/projectdiscovery/httpx/releases/download/v1.7.1/httpx_1.7.1_linux_amd64.zip",
+          "sha256": "UNPINNED",
+          "archive": "zip",
+          "member": "httpx"
+        }
+      },
+      "required_flags": [
+        "-duc",
+        "-silent"
+      ],
+      "forbidden_flags": [
+        "-pd",
+        "-dashboard",
+        "-auth"
+      ]
+    },
+    "semgrep": {
+      "version": "1.180.0",
+      "licence": "LGPL-2.1",
+      "class": "external-only",
+      "homepage": "https://github.com/semgrep/semgrep",
+      "version_args": [
+        "--version"
+      ],
+      "required_flags": [
+        "--metrics=off",
+        "--disable-version-check"
+      ],
+      "forbidden_flags": [
+        "--config=auto",
+        "--config=p/",
+        "--config=r/",
+        "login",
+        "ci",
+        "publish",
+        "--pro"
+      ],
+      "env": {
+        "SEMGREP_SEND_METRICS": "off"
+      },
+      "notes": "LGPL-2.1: installed by the person (pipx install semgrep==1.180.0); Maggie calls it as a separate process with --metrics=off and only the packaged Maggie rule pack or local rule folders.",
+      "flags_after_subcommand": true
+    },
+    "testssl.sh": {
+      "version": "3.2.1",
+      "licence": "GPL-2.0",
+      "class": "external-only",
+      "homepage": "https://github.com/testssl/testssl.sh",
+      "binary": "testssl.sh",
+      "required_flags": [
+        "--quiet"
+      ],
+      "forbidden_flags": [
+        "--phone-out"
+      ],
+      "notes": "GPL: download from upstream yourself; Maggie calls it as a separate process."
+    },
+    "lynis": {
+      "version": "3.1.5",
+      "licence": "GPL-3.0",
+      "class": "external-only",
+      "homepage": "https://github.com/CISOfy/lynis",
+      "required_flags": [],
+      "forbidden_flags": [
+        "--upload"
+      ],
+      "notes": "GPL: run from the upstream tarball on the host; never vendored."
+    },
+    "goaccess": {
+      "version": "1.9.4",
+      "licence": "MIT",
+      "class": "external-only",
+      "homepage": "https://github.com/allinurl/goaccess",
+      "required_flags": [],
+      "forbidden_flags": [
+        "--real-time-html",
+        "--daemonize"
+      ],
+      "notes": "Install with the OS package manager (apt install goaccess)."
+    },
+    "lnav": {
+      "version": "0.13.2",
+      "licence": "BSD-2-Clause",
+      "class": "external-only",
+      "homepage": "https://github.com/tstack/lnav",
+      "required_flags": [
+        "-n"
+      ],
+      "forbidden_flags": []
+    },
+    "syft": {
+      "version": "1.33.0",
+      "licence": "Apache-2.0",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/anchore/syft",
+      "assets": {
+        "linux-amd64": {
+          "url": "https://github.com/anchore/syft/releases/download/v1.33.0/syft_1.33.0_linux_amd64.tar.gz",
+          "sha256": "UNPINNED",
+          "archive": "tar.gz",
+          "member": "syft"
+        }
+      },
+      "required_flags": [],
+      "forbidden_flags": [],
+      "env": {
+        "SYFT_CHECK_FOR_APP_UPDATE": "false"
+      }
+    },
+    "grype": {
+      "version": "0.100.0",
+      "licence": "Apache-2.0",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/anchore/grype",
+      "assets": {
+        "linux-amd64": {
+          "url": "https://github.com/anchore/grype/releases/download/v0.100.0/grype_0.100.0_linux_amd64.tar.gz",
+          "sha256": "UNPINNED",
+          "archive": "tar.gz",
+          "member": "grype"
+        }
+      },
+      "required_flags": [],
+      "forbidden_flags": [],
+      "env": {
+        "GRYPE_CHECK_FOR_APP_UPDATE": "false"
+      }
+    },
+    "trivy": {
+      "version": "0.67.2",
+      "licence": "Apache-2.0",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/aquasecurity/trivy",
+      "assets": {
+        "linux-amd64": {
+          "url": "https://github.com/aquasecurity/trivy/releases/download/v0.67.2/trivy_0.67.2_Linux-64bit.tar.gz",
+          "sha256": "UNPINNED",
+          "archive": "tar.gz",
+          "member": "trivy"
+        }
+      },
+      "required_flags": [
+        "--quiet"
+      ],
+      "forbidden_flags": [
+        "--server"
+      ]
+    },
+    "dockle": {
+      "version": "0.4.15",
+      "licence": "Apache-2.0",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/goodwithtech/dockle",
+      "required_flags": [],
+      "forbidden_flags": []
+    },
+    "gatus": {
+      "version": "5.26.0",
+      "licence": "Apache-2.0",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/TwiN/gatus",
+      "required_flags": [],
+      "forbidden_flags": [],
+      "notes": "Deployed as a container by uptime-deploy; not run locally."
+    },
+    "skillspector": {
+      "version": "2.12.0",
+      "licence": "Apache-2.0",
+      "class": "external-only",
+      "homepage": "https://github.com/NVIDIA/SkillSpector",
+      "required_flags": [
+        "--no-llm"
+      ],
+      "forbidden_flags": [
+        "--llm",
+        "--semantic",
+        "--provider"
+      ],
+      "binary": "skillspector",
+      "flags_after_subcommand": true,
+      "notes": "Apache-2.0, Python 3.12+: install it yourself with `pipx install --python python3.12 skillspector==2.12.0` (or `uv tool install skillspector==2.12.0`). Maggie forces --no-llm."
+    },
+    "bumblebee": {
+      "version": "0.1.0",
+      "licence": "MIT",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/perplexityai/bumblebee",
+      "required_flags": [],
+      "forbidden_flags": []
+    },
+    "npq": {
+      "version": "3.8.0",
+      "licence": "Apache-2.0",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/lirantal/npq",
+      "required_flags": [
+        "--dry-run"
+      ],
+      "forbidden_flags": [],
+      "notes": "npm package; run with npx --yes npq@3.8.0 --dry-run."
+    },
+    "trufflehog": {
+      "version": "n/a",
+      "licence": "AGPL-3.0",
+      "class": "reference-only",
+      "homepage": "https://github.com/trufflesecurity/trufflehog",
+      "notes": "Design reference only; gitleaks is the secrets scanner."
+    },
+    "maggie-waf-replay": {
+      "version": "0.1.0",
+      "licence": "MIT (Coraza and OWASP CRS: Apache-2.0)",
+      "class": "bundle-ok",
+      "binary": "maggie-waf-replay",
+      "homepage": "tools/go/waf-replay",
+      "required_flags": [],
+      "forbidden_flags": [],
+      "notes": "Built from tools/go/waf-replay (go build -trimpath). Release CI is to publish per-platform assets with sha256 here; until then build it yourself and put it on PATH."
+    }
+  }
+}

package/bundled-tools/integrations/maggie-api-pull.md

@@ -89,13 +89,40 @@ back to an older stored URL, which after a platform move answers 404. So:
    `maggie blog live-urls match --sitemap https://example.com/sitemap.xml --write --report-body .maggie/live-urls-report.json`,
    then send that body with `maggie api report-state --body-file … --execute`.
 
-Matching is **additive**: a post that already has a live URL keeps it, and a
+Every post without a live URL is a candidate, including one already tracked
+with an empty value; when the record has no slug, the last path segment of its
+delivered address is used. Matching is **additive**: a post that already has a live URL keeps it, and a
 post this run did not find is left as it was — never marked unmatched — so the
 match can run daily without retiring earlier matches. When translated copies
 share the slug (`/blog/x`, `/zh-hans/blog/x`), the URL **without a locale
 segment** wins. The same two rules apply to the platform's own sitemap
 matching for API Pull destinations.
 
+## Rewrites on pull sites
+
+A pull site receives rewrites the same way it receives posts: `GET /updates`
+on the same schedule as `/posts` (one rewrite per call, charged like a post;
+the answer is `{delivered, updates: [...]}`). Without this path a rewrite
+requested for a pulled post never reaches the site. Each rewrite is applied to
+the post it is for, never stored as a new post:
+
+1. Find the post by `source_content_id` (the id `/posts` delivered it under),
+   else by its slug or address, previous slugs included.
+2. Replace only the body. Title, slug, status, topics and the live URL stay as
+   the site has them.
+3. Keep the replaced body (and its checksum) so the rewrite can be undone.
+4. A rewrite with `publication_status: "draft"` is held for review, and one
+   with no matching post here is kept as `unmatched`; neither is applied.
+5. Translations of a rewritten post are stale: queue them again.
+6. Report the outcome with `POST /content-tracking/report-state`.
+
+`maggie api lifecycle --execute --allow-quota --pull-updates` does steps 1, 2,
+4 locally: the rewrite lands on the original record in
+`.maggie/ai-cmo-lifecycle.json` (`rewrite_pending`, a `rewrites` history with
+the previous checksum), held ones are listed without changing the body, and
+unmatched ones go to `rewrites_unmatched`. A later `/posts` re-delivery keeps
+the record's live URL and rewrite history.
+
 ## Project context synchronization
 
 `GET /project-context` returns sanitized, read-only context scoped by the API

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.54",
+  "version": "0.7.56",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",