@topy-ai/maggie 0.7.59 → 0.7.60

package/README-zh-TW.md

@@ -143,7 +143,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 npm 版本為 `0.7.59`，包含 fix-plan、public-check、Maggie Security、batch 31 排程 agent routines、報告收件匣與無人值守 agent 限制、PHP runtime 盤點與主機鎖、pull 網站改寫、query 點子與社群佇列檢查，batch 30 MaggieDash 先裝核心、release privacy gate、feedback 備援、社群連結與圖片檢查、大量頁面產生與 app 檢查，batch 29 預約規則、部署、app QA、助理與社群功能，以及 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 npm 版本為 `0.7.60`，包含 fix-plan、public-check、Maggie Security、batch 31 排程 agent routines、報告收件匣與無人值守 agent 限制、PHP runtime 盤點與主機鎖、pull 網站改寫、query 點子與社群佇列檢查，batch 30 MaggieDash 先裝核心、release privacy gate、feedback 備援、社群連結與圖片檢查、大量頁面產生與 app 檢查，batch 29 預約規則、部署、app QA、助理與社群功能，以及 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -89,7 +89,9 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 23 installable skills and a local-first MaggieDash foundation.
 
-This package is `0.7.59`. It makes `maggie security host-audit` (the deep
+This package is `0.7.60`. `maggie security fix-plan` now emits **runnable** nginx fixes: http-context directives (TLS protocols, `server_tokens`) go into a global `conf.d` drop-in, and server-context ones (deny dotfiles, `proxy_hide_header`) into a snippet file applied with a backed-up, `nginx -t`-validated, auto-reverting `include`.
+
+The 0.7.59 release made `maggie security host-audit` (the deep
 lynis audit over SSH) robust on hosts where a storage test can stall: lynis runs
 in its own process group under a watchdog, and the bundled profile skips the ZFS
 storage/filesystem tests that hang, so the audit completes instead of timing out.
@@ -856,8 +858,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.59 update --scope project --project . --force
-npx @topy-ai/maggie@0.7.59 cleanup --scope project --project .
+npx @topy-ai/maggie@0.7.60 update --scope project --project . --force
+npx @topy-ai/maggie@0.7.60 cleanup --scope project --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never

package/bundled-tools/clis/maggie_security_report.py

@@ -15,6 +15,7 @@ from __future__ import annotations
 import argparse
 import json
 import re
+import shlex
 from pathlib import Path
 
 import maggie_security_core as core
@@ -557,6 +558,71 @@ def fix_commands(action: dict) -> tuple[list[str], list[tuple[str, str]], list[s
     return commands, snippets, todos
 
 
+# nginx directives valid in the http{} context can be dropped into conf.d; the
+# rest (location/proxy/add_header) must live in a server{} block.
+NGINX_HTTP_DIRECTIVES = {"ssl_protocols", "ssl_ciphers", "ssl_prefer_server_ciphers", "ssl_ecdh_curve",
+                         "ssl_session_tickets", "ssl_session_timeout", "ssl_dhparam", "server_tokens"}
+NGINX_FILE_RE = re.compile(r"(/etc/nginx/[\w./-]+\.conf)")
+
+
+def nginx_fix_block(actions: list[dict]) -> tuple[list[str], list[str]]:
+    """Runnable nginx fixes: a global drop-in for http-context directives, and a
+    snippet file + a guarded, reversible `include` for server-context ones."""
+    http_dirs: list[tuple[str, dict]] = []
+    server_by_file: dict[str, list[str]] = {}
+    manual: list[dict] = []
+    for action in actions:
+        rem = action["lead"].get("remediation") or {}
+        snippets = [s.get("text", "").strip() for s in (rem.get("snippets") or []) if s.get("text")]
+        if not snippets:
+            manual.append(action)
+            continue
+        tp = (action["lead"].get("target") or {}).get("path") or ""
+        match = NGINX_FILE_RE.search(tp) or NGINX_FILE_RE.search(action["lead"].get("title", ""))
+        vfile = match.group(1) if match else None
+        for text in snippets:
+            name = text.split()[0] if text.split() else ""
+            if name in NGINX_HTTP_DIRECTIVES:
+                http_dirs.append((text, action))
+            elif vfile:
+                server_by_file.setdefault(vfile, [])
+                if text not in server_by_file[vfile]:
+                    server_by_file[vfile].append(text)
+            else:
+                manual.append(action)
+    sh: list[str] = []
+    md: list[str] = []
+    if http_dirs:
+        directives = list(dict.fromkeys(d for d, _ in http_dirs))
+        fixes = "; ".join(dict.fromkeys(a["title"] for _, a in http_dirs))
+        body = "".join(d + "\n" for d in directives)
+        sh += [f"# Global TLS/hardening — fixes: {fixes}",
+               f"printf %s {shlex.quote(body)} | sudo tee /etc/nginx/conf.d/00-maggie-hardening.conf >/dev/null",
+               "sudo nginx -t && sudo systemctl reload nginx", ""]
+        md.append("- **nginx global hardening** → drop-in `/etc/nginx/conf.d/00-maggie-hardening.conf`: "
+                  + ", ".join(f"`{d}`" for d in directives))
+    for vfile, directives in server_by_file.items():
+        stem = re.sub(r"[^\w.-]", "_", re.sub(r"\.conf$", "", vfile.rsplit("/", 1)[-1]))
+        snip = f"/etc/nginx/snippets/maggie-{stem}.conf"
+        heredoc = "\n".join(directives)
+        sh += [f"# Harden {vfile} (backs up, validates, auto-reverts on error)",
+               f"sudo tee {snip} >/dev/null <<'MAGGIE_SNIP'",
+               heredoc,
+               "MAGGIE_SNIP",
+               f"sudo cp -a {shlex.quote(vfile)} {shlex.quote(vfile + '.maggie.bak')}",
+               f"sudo sed -i -E '/^[[:space:]]*server[[:space:]]*\\{{[[:space:]]*$/a\\    include {snip};' {shlex.quote(vfile)}",
+               f"sudo nginx -t && sudo systemctl reload nginx || {{ echo 'nginx test failed — reverting'; "
+               f"sudo cp -a {shlex.quote(vfile + '.maggie.bak')} {shlex.quote(vfile)}; sudo systemctl reload nginx; }}", ""]
+        md.append(f"- **nginx vhost hardening** (`{vfile}` via `{snip}` + guarded include): "
+                  + ", ".join(f"`{d}`" for d in directives))
+    for action in manual:
+        rem = action["lead"].get("remediation") or {}
+        sh += [f"# [{action['priority']}] {action['title']} — {action['why']}",
+               f"#   TODO (manual): {rem.get('summary') or action['how']}", ""]
+        md.append(f"- **{action['title']}** — {rem.get('summary') or action['how']} _(manual)_")
+    return sh, md
+
+
 def fix_plan(ctx: core.Context) -> dict:
     args = ctx.args
     since = resolve_since(ctx, args.since)
@@ -597,6 +663,12 @@ def fix_plan(ctx: core.Context) -> dict:
             continue
         sh += [f"# =================== {label} ===================", f"# {note}", ""]
         md += [f"## {label}", f"_{note}_", ""]
+        if key == "web-server":
+            block_sh, block_md = nginx_fix_block(items)
+            sh += block_sh
+            md += block_md
+            total += len(items)
+            continue
         for action in items:
             total += 1
             sh.append(f"# [{action['priority']}] {action['title']} — {action['why']}")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.59",
+  "version": "0.7.60",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",