@topy-ai/maggie 0.7.58 → 0.7.59

package/README-zh-TW.md

@@ -143,7 +143,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 npm 版本為 `0.7.58`，包含 fix-plan、public-check、Maggie Security、batch 31 排程 agent routines、報告收件匣與無人值守 agent 限制、PHP runtime 盤點與主機鎖、pull 網站改寫、query 點子與社群佇列檢查，batch 30 MaggieDash 先裝核心、release privacy gate、feedback 備援、社群連結與圖片檢查、大量頁面產生與 app 檢查，batch 29 預約規則、部署、app QA、助理與社群功能，以及 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 npm 版本為 `0.7.59`，包含 fix-plan、public-check、Maggie Security、batch 31 排程 agent routines、報告收件匣與無人值守 agent 限制、PHP runtime 盤點與主機鎖、pull 網站改寫、query 點子與社群佇列檢查，batch 30 MaggieDash 先裝核心、release privacy gate、feedback 備援、社群連結與圖片檢查、大量頁面產生與 app 檢查，batch 29 預約規則、部署、app QA、助理與社群功能，以及 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -89,7 +89,12 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 23 installable skills and a local-first MaggieDash foundation.
 
-This package is `0.7.58`. It adds `maggie security fix-plan` — a
+This package is `0.7.59`. It makes `maggie security host-audit` (the deep
+lynis audit over SSH) robust on hosts where a storage test can stall: lynis runs
+in its own process group under a watchdog, and the bundled profile skips the ZFS
+storage/filesystem tests that hang, so the audit completes instead of timing out.
+
+The 0.7.58 release added `maggie security fix-plan` — a
 reviewed remediation runbook built from the open findings (file permissions,
 firewall, package/apt updates, intrusion prevention, web-server config, end of
 life). It writes a shell script you run yourself, under a host lock, after a
@@ -851,8 +856,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.58 update --scope project --project . --force
-npx @topy-ai/maggie@0.7.58 cleanup --scope project --project .
+npx @topy-ai/maggie@0.7.59 update --scope project --project . --force
+npx @topy-ai/maggie@0.7.59 cleanup --scope project --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never

package/bundled-tools/clis/maggie_security_host.py

@@ -266,18 +266,38 @@ def lynis_findings(ctx: core.Context, data: dict, host: str) -> list[dict]:
 
 
 LYNIS_PROFILE = """# Maggie lynis profile: no upload, skip tests that do not apply to web servers
+# and skip the storage/filesystem enumeration that hangs on ZFS hosts
+# (the remote watchdog below is the backstop if anything else stalls).
 upload=no
 skip-test=PRNT-2307
 skip-test=PRNT-2308
 skip-test=STRG-1840
 skip-test=STRG-1842
+skip-test=STRG-1846
+skip-test=STRG-1902
 skip-test=NAME-4402
 skip-test=NAME-4404
 skip-test=KRB-5108
 skip-test=LDAP-2219
-skip-test=STRG-1902
+skip-test=FILE-6310
+skip-test=FILE-6311
+skip-test=FILE-6329
+skip-test=FILE-6330
+skip-test=FILE-6332
+skip-test=FILE-6336
+skip-test=FILE-6354
+skip-test=FILE-6362
+skip-test=FILE-6368
+skip-test=FILE-6374
+skip-test=FILE-6376
 """
 
+# A ZFS host can wedge a lynis storage test for a very long time, and killing the
+# ssh client leaves the stuck test running and holding the channel. So we run
+# lynis in its own process group under a remote watchdog that SIGKILLs the whole
+# group; the command always returns and flushes, finished or not.
+LYNIS_WATCHDOG_SECONDS = 600
+
 
 def host_audit(ctx: core.Context):
     args = ctx.args
@@ -329,15 +349,21 @@ def remote_lynis(ctx: core.Context, alias: str, target: str) -> dict:
         subprocess.run(["ssh", "-o", "BatchMode=yes", target, f"umask 077 && mkdir -p {remote_dir}"], check=True, timeout=60)
         subprocess.run(["scp", "-q", "-o", "BatchMode=yes", str(tarball), f"{target}:{remote_dir}/lynis.tar.gz"], check=True, timeout=300)
         profile = shlex.quote(LYNIS_PROFILE)
-        # Run lynis with sudo when available (a full audit needs root); read the
-        # report back with the SAME sudo, because a root run writes report.dat
-        # root-owned and 0600 — a plain `cat` as the login user reads nothing.
+        # Run lynis with sudo when available (a full audit needs root). Run it in
+        # its own session (setsid) under a watchdog that SIGKILLs the whole process
+        # group if it overruns, so a stuck storage test cannot hang the session or
+        # leave an orphan holding the ssh channel. Read report.dat back with the
+        # same sudo (a root run writes it 0600, so a plain cat reads nothing).
+        inner = (f"setsid ./lynis audit system --quick --no-colors --no-log "
+                 f"--profile {remote_dir}/maggie.prf --report-file {remote_dir}/report.dat --logfile /dev/null >/dev/null 2>&1 & "
+                 f"LP=$!; ( sleep {LYNIS_WATCHDOG_SECONDS}; kill -9 -$LP 2>/dev/null ) & WD=$!; "
+                 f"wait $LP 2>/dev/null; kill $WD 2>/dev/null")
         script = (f"SUDO=$( [ $(id -u) != 0 ] && sudo -n true 2>/dev/null && echo 'sudo -n' ); "
                   f"cd {remote_dir} && tar xzf lynis.tar.gz && printf %s {profile} > maggie.prf && cd lynis && "
-                  f"$SUDO ./lynis audit system --quick --no-colors --no-log "
-                  f"--profile {remote_dir}/maggie.prf --report-file {remote_dir}/report.dat --logfile /dev/null >/dev/null 2>&1; "
-                  f"$SUDO cat {remote_dir}/report.dat")
-        proc = subprocess.run(["ssh", "-o", "BatchMode=yes", target, script], capture_output=True, text=True, timeout=1800, check=False)
+                  f"$SUDO sh -c {shlex.quote(inner)} </dev/null >/dev/null 2>&1; "
+                  f"$SUDO cat {remote_dir}/report.dat 2>/dev/null")
+        proc = subprocess.run(["ssh", "-o", "BatchMode=yes", target, script], input="", capture_output=True, text=True,
+                              timeout=LYNIS_WATCHDOG_SECONDS + 180, check=False)
         report = proc.stdout
     finally:
         subprocess.run(["ssh", "-o", "BatchMode=yes", target, f"rm -rf {remote_dir}"], timeout=60, check=False)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.58",
+  "version": "0.7.59",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",