@topy-ai/maggie 0.7.58 → 0.7.60

package/README-zh-TW.md

@@ -143,7 +143,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 npm 版本為 `0.7.58`，包含 fix-plan、public-check、Maggie Security、batch 31 排程 agent routines、報告收件匣與無人值守 agent 限制、PHP runtime 盤點與主機鎖、pull 網站改寫、query 點子與社群佇列檢查，batch 30 MaggieDash 先裝核心、release privacy gate、feedback 備援、社群連結與圖片檢查、大量頁面產生與 app 檢查，batch 29 預約規則、部署、app QA、助理與社群功能，以及 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 npm 版本為 `0.7.60`，包含 fix-plan、public-check、Maggie Security、batch 31 排程 agent routines、報告收件匣與無人值守 agent 限制、PHP runtime 盤點與主機鎖、pull 網站改寫、query 點子與社群佇列檢查，batch 30 MaggieDash 先裝核心、release privacy gate、feedback 備援、社群連結與圖片檢查、大量頁面產生與 app 檢查，batch 29 預約規則、部署、app QA、助理與社群功能，以及 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -89,7 +89,14 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 23 installable skills and a local-first MaggieDash foundation.
 
-This package is `0.7.58`. It adds `maggie security fix-plan` — a
+This package is `0.7.60`. `maggie security fix-plan` now emits **runnable** nginx fixes: http-context directives (TLS protocols, `server_tokens`) go into a global `conf.d` drop-in, and server-context ones (deny dotfiles, `proxy_hide_header`) into a snippet file applied with a backed-up, `nginx -t`-validated, auto-reverting `include`.
+
+The 0.7.59 release made `maggie security host-audit` (the deep
+lynis audit over SSH) robust on hosts where a storage test can stall: lynis runs
+in its own process group under a watchdog, and the bundled profile skips the ZFS
+storage/filesystem tests that hang, so the audit completes instead of timing out.
+
+The 0.7.58 release added `maggie security fix-plan` — a
 reviewed remediation runbook built from the open findings (file permissions,
 firewall, package/apt updates, intrusion prevention, web-server config, end of
 life). It writes a shell script you run yourself, under a host lock, after a
@@ -851,8 +858,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.58 update --scope project --project . --force
-npx @topy-ai/maggie@0.7.58 cleanup --scope project --project .
+npx @topy-ai/maggie@0.7.60 update --scope project --project . --force
+npx @topy-ai/maggie@0.7.60 cleanup --scope project --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never

package/bundled-tools/clis/maggie_security_host.py

@@ -266,18 +266,38 @@ def lynis_findings(ctx: core.Context, data: dict, host: str) -> list[dict]:
 
 
 LYNIS_PROFILE = """# Maggie lynis profile: no upload, skip tests that do not apply to web servers
+# and skip the storage/filesystem enumeration that hangs on ZFS hosts
+# (the remote watchdog below is the backstop if anything else stalls).
 upload=no
 skip-test=PRNT-2307
 skip-test=PRNT-2308
 skip-test=STRG-1840
 skip-test=STRG-1842
+skip-test=STRG-1846
+skip-test=STRG-1902
 skip-test=NAME-4402
 skip-test=NAME-4404
 skip-test=KRB-5108
 skip-test=LDAP-2219
-skip-test=STRG-1902
+skip-test=FILE-6310
+skip-test=FILE-6311
+skip-test=FILE-6329
+skip-test=FILE-6330
+skip-test=FILE-6332
+skip-test=FILE-6336
+skip-test=FILE-6354
+skip-test=FILE-6362
+skip-test=FILE-6368
+skip-test=FILE-6374
+skip-test=FILE-6376
 """
 
+# A ZFS host can wedge a lynis storage test for a very long time, and killing the
+# ssh client leaves the stuck test running and holding the channel. So we run
+# lynis in its own process group under a remote watchdog that SIGKILLs the whole
+# group; the command always returns and flushes, finished or not.
+LYNIS_WATCHDOG_SECONDS = 600
+
 
 def host_audit(ctx: core.Context):
     args = ctx.args
@@ -329,15 +349,21 @@ def remote_lynis(ctx: core.Context, alias: str, target: str) -> dict:
         subprocess.run(["ssh", "-o", "BatchMode=yes", target, f"umask 077 && mkdir -p {remote_dir}"], check=True, timeout=60)
         subprocess.run(["scp", "-q", "-o", "BatchMode=yes", str(tarball), f"{target}:{remote_dir}/lynis.tar.gz"], check=True, timeout=300)
         profile = shlex.quote(LYNIS_PROFILE)
-        # Run lynis with sudo when available (a full audit needs root); read the
-        # report back with the SAME sudo, because a root run writes report.dat
-        # root-owned and 0600 — a plain `cat` as the login user reads nothing.
+        # Run lynis with sudo when available (a full audit needs root). Run it in
+        # its own session (setsid) under a watchdog that SIGKILLs the whole process
+        # group if it overruns, so a stuck storage test cannot hang the session or
+        # leave an orphan holding the ssh channel. Read report.dat back with the
+        # same sudo (a root run writes it 0600, so a plain cat reads nothing).
+        inner = (f"setsid ./lynis audit system --quick --no-colors --no-log "
+                 f"--profile {remote_dir}/maggie.prf --report-file {remote_dir}/report.dat --logfile /dev/null >/dev/null 2>&1 & "
+                 f"LP=$!; ( sleep {LYNIS_WATCHDOG_SECONDS}; kill -9 -$LP 2>/dev/null ) & WD=$!; "
+                 f"wait $LP 2>/dev/null; kill $WD 2>/dev/null")
         script = (f"SUDO=$( [ $(id -u) != 0 ] && sudo -n true 2>/dev/null && echo 'sudo -n' ); "
                   f"cd {remote_dir} && tar xzf lynis.tar.gz && printf %s {profile} > maggie.prf && cd lynis && "
-                  f"$SUDO ./lynis audit system --quick --no-colors --no-log "
-                  f"--profile {remote_dir}/maggie.prf --report-file {remote_dir}/report.dat --logfile /dev/null >/dev/null 2>&1; "
-                  f"$SUDO cat {remote_dir}/report.dat")
-        proc = subprocess.run(["ssh", "-o", "BatchMode=yes", target, script], capture_output=True, text=True, timeout=1800, check=False)
+                  f"$SUDO sh -c {shlex.quote(inner)} </dev/null >/dev/null 2>&1; "
+                  f"$SUDO cat {remote_dir}/report.dat 2>/dev/null")
+        proc = subprocess.run(["ssh", "-o", "BatchMode=yes", target, script], input="", capture_output=True, text=True,
+                              timeout=LYNIS_WATCHDOG_SECONDS + 180, check=False)
         report = proc.stdout
     finally:
         subprocess.run(["ssh", "-o", "BatchMode=yes", target, f"rm -rf {remote_dir}"], timeout=60, check=False)

package/bundled-tools/clis/maggie_security_report.py

@@ -15,6 +15,7 @@ from __future__ import annotations
 import argparse
 import json
 import re
+import shlex
 from pathlib import Path
 
 import maggie_security_core as core
@@ -557,6 +558,71 @@ def fix_commands(action: dict) -> tuple[list[str], list[tuple[str, str]], list[s
     return commands, snippets, todos
 
 
+# nginx directives valid in the http{} context can be dropped into conf.d; the
+# rest (location/proxy/add_header) must live in a server{} block.
+NGINX_HTTP_DIRECTIVES = {"ssl_protocols", "ssl_ciphers", "ssl_prefer_server_ciphers", "ssl_ecdh_curve",
+                         "ssl_session_tickets", "ssl_session_timeout", "ssl_dhparam", "server_tokens"}
+NGINX_FILE_RE = re.compile(r"(/etc/nginx/[\w./-]+\.conf)")
+
+
+def nginx_fix_block(actions: list[dict]) -> tuple[list[str], list[str]]:
+    """Runnable nginx fixes: a global drop-in for http-context directives, and a
+    snippet file + a guarded, reversible `include` for server-context ones."""
+    http_dirs: list[tuple[str, dict]] = []
+    server_by_file: dict[str, list[str]] = {}
+    manual: list[dict] = []
+    for action in actions:
+        rem = action["lead"].get("remediation") or {}
+        snippets = [s.get("text", "").strip() for s in (rem.get("snippets") or []) if s.get("text")]
+        if not snippets:
+            manual.append(action)
+            continue
+        tp = (action["lead"].get("target") or {}).get("path") or ""
+        match = NGINX_FILE_RE.search(tp) or NGINX_FILE_RE.search(action["lead"].get("title", ""))
+        vfile = match.group(1) if match else None
+        for text in snippets:
+            name = text.split()[0] if text.split() else ""
+            if name in NGINX_HTTP_DIRECTIVES:
+                http_dirs.append((text, action))
+            elif vfile:
+                server_by_file.setdefault(vfile, [])
+                if text not in server_by_file[vfile]:
+                    server_by_file[vfile].append(text)
+            else:
+                manual.append(action)
+    sh: list[str] = []
+    md: list[str] = []
+    if http_dirs:
+        directives = list(dict.fromkeys(d for d, _ in http_dirs))
+        fixes = "; ".join(dict.fromkeys(a["title"] for _, a in http_dirs))
+        body = "".join(d + "\n" for d in directives)
+        sh += [f"# Global TLS/hardening — fixes: {fixes}",
+               f"printf %s {shlex.quote(body)} | sudo tee /etc/nginx/conf.d/00-maggie-hardening.conf >/dev/null",
+               "sudo nginx -t && sudo systemctl reload nginx", ""]
+        md.append("- **nginx global hardening** → drop-in `/etc/nginx/conf.d/00-maggie-hardening.conf`: "
+                  + ", ".join(f"`{d}`" for d in directives))
+    for vfile, directives in server_by_file.items():
+        stem = re.sub(r"[^\w.-]", "_", re.sub(r"\.conf$", "", vfile.rsplit("/", 1)[-1]))
+        snip = f"/etc/nginx/snippets/maggie-{stem}.conf"
+        heredoc = "\n".join(directives)
+        sh += [f"# Harden {vfile} (backs up, validates, auto-reverts on error)",
+               f"sudo tee {snip} >/dev/null <<'MAGGIE_SNIP'",
+               heredoc,
+               "MAGGIE_SNIP",
+               f"sudo cp -a {shlex.quote(vfile)} {shlex.quote(vfile + '.maggie.bak')}",
+               f"sudo sed -i -E '/^[[:space:]]*server[[:space:]]*\\{{[[:space:]]*$/a\\    include {snip};' {shlex.quote(vfile)}",
+               f"sudo nginx -t && sudo systemctl reload nginx || {{ echo 'nginx test failed — reverting'; "
+               f"sudo cp -a {shlex.quote(vfile + '.maggie.bak')} {shlex.quote(vfile)}; sudo systemctl reload nginx; }}", ""]
+        md.append(f"- **nginx vhost hardening** (`{vfile}` via `{snip}` + guarded include): "
+                  + ", ".join(f"`{d}`" for d in directives))
+    for action in manual:
+        rem = action["lead"].get("remediation") or {}
+        sh += [f"# [{action['priority']}] {action['title']} — {action['why']}",
+               f"#   TODO (manual): {rem.get('summary') or action['how']}", ""]
+        md.append(f"- **{action['title']}** — {rem.get('summary') or action['how']} _(manual)_")
+    return sh, md
+
+
 def fix_plan(ctx: core.Context) -> dict:
     args = ctx.args
     since = resolve_since(ctx, args.since)
@@ -597,6 +663,12 @@ def fix_plan(ctx: core.Context) -> dict:
             continue
         sh += [f"# =================== {label} ===================", f"# {note}", ""]
         md += [f"## {label}", f"_{note}_", ""]
+        if key == "web-server":
+            block_sh, block_md = nginx_fix_block(items)
+            sh += block_sh
+            md += block_md
+            total += len(items)
+            continue
         for action in items:
             total += 1
             sh.append(f"# [{action['priority']}] {action['title']} — {action['why']}")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.58",
+  "version": "0.7.60",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",