@topy-ai/maggie 0.7.59 → 0.7.61

package/README-zh-TW.md

@@ -143,7 +143,7 @@ structure drift 或重複 treatment product 時 fail closed。
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-目前 npm 版本為 `0.7.59`，包含 fix-plan、public-check、Maggie Security、batch 31 排程 agent routines、報告收件匣與無人值守 agent 限制、PHP runtime 盤點與主機鎖、pull 網站改寫、query 點子與社群佇列檢查，batch 30 MaggieDash 先裝核心、release privacy gate、feedback 備援、社群連結與圖片檢查、大量頁面產生與 app 檢查，batch 29 預約規則、部署、app QA、助理與社群功能，以及 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
+目前 npm 版本為 `0.7.61`，包含 fix-plan 修補風險分級 T1–T4(判斷補丁是否安全套用)與 host-impact 補丁影響面量測(哪些服務需重啟、是否需重開機)、public-check、Maggie Security、batch 31 排程 agent routines、報告收件匣與無人值守 agent 限制、PHP runtime 盤點與主機鎖、pull 網站改寫、query 點子與社群佇列檢查，batch 30 MaggieDash 先裝核心、release privacy gate、feedback 備援、社群連結與圖片檢查、大量頁面產生與 app 檢查，batch 29 預約規則、部署、app QA、助理與社群功能，以及 batch 28 產品 app、assistant tools、mobile、product release、skills catalog 與 bridge host 功能、batch 26、27 feedback 修正與 idempotent `maggie update`與 Booking email-template 合約/CLI validator 同步。本版完成 2026-09-24 booking feedback batch：Calendar grid/free-slot entry 與 host modal focus-restoration evidence。本版新增 Starter marketplace provisioning plan；本版完成 feedback batches 22、23：加入 declarative browser interaction evidence、design markup/style/content-key gate、compiler source anchoring、entity double-escape protection、`update --help` read-only、noindex hypothetical indexability、可過期 baseline acknowledgement、DOM-only link extraction regression，以及 MaggieDash 0.2.10 的 content override、短期 browser session、CDN-safe public-session cache contracts。authentication 和 isolated dev server 仍由 host 負責。`maggie-booking` workflow、傳統 email/password、Stripe、Resend、public booking flow 及既有安全邊界維持不變；provider-bound video generation 與 transactional delivery 仍記錄在 issue #39，前一批延後功能仍在 issue #38，不會直接成為 active memory。0.7.33 記錄並審查一筆更正回饋；確認 0.7.32 已正確處理 batch index，沒有修改已驗證的 shared behavior。0.7.32 加入 feedback 一基索引支援、MaggieDash panel 的 source/freshness/error evidence、Consent Mode 與實際 write/no-op reconciliation、SEO baseline recapture、sitemap origin rebasing、content-diff scope、migration ledger reconciliation、deployment credential preflight、release provenance/runtime preflight、icon release gate、opt-in blog auto-publish gate，以及 least-privilege VPS deployer。也修復 top-level `maggie feedback` dispatcher parity。0.7.31 加入 update 差異摘要、atomic installer copy、subset install manifest merge，以及 inventory drift 時 doctor non-zero。0.7.30 補上 feedback tracking issue closeout gate 與 batch 14/15 audit ledger。0.7.29 修正 npm package landing page 使用英文 README；0.7.28 加入 versioned Gemini model policy、明確 fallback 與 provenance、bundled-first CLI
 dispatch、`maggie --version`、feedback batch review 聚合與重複偵測、marketplace enrichment evidence、booking
 worker/resolver evidence，以及 read-only migration preflight。它也包含 host-owned mobile app surface contract、signed-in
 camera-state QA、直接 Astro route resolution、correlated feedback batch，以及

package/README.md

@@ -89,7 +89,9 @@ Maggie keeps the existing project foundation and asks for decisions before
 shared routes, analytics, or publishing boundaries change. The current
 package ships 23 installable skills and a local-first MaggieDash foundation.
 
-This package is `0.7.59`. It makes `maggie security host-audit` (the deep
+This package is `0.7.61` — safe patching. `maggie security fix-plan` tags every action with a **fix-risk tier** T1–T4 — whether a patch is safe to apply, not just what to patch: T1 batch-safe distro/permission fixes, T2 restart+smoke-test, T3 config hardening that validates and auto-rolls-back, T4 major/EOL moves emitted as accepted-risk drafts to stage first. New `maggie security host-impact` (read-only) measures each patch's **blast radius** — which pending updates are security-only, which running services must restart to make a fix live (`needrestart`), and whether a reboot is pending — and feeds it back into the plan.
+
+The 0.7.59 release made `maggie security host-audit` (the deep
 lynis audit over SSH) robust on hosts where a storage test can stall: lynis runs
 in its own process group under a watchdog, and the bundled profile skips the ZFS
 storage/filesystem tests that hang, so the audit completes instead of timing out.
@@ -109,7 +111,7 @@ interactive-only and never probes, submits or scans; the active scanners
 (`web-scan`, `zap-baseline`) and host checks stay verified-only.
 
 The 0.7.56 release added Maggie Security, a new
-`maggie-security` skill and `maggie security` command family (48 commands, 30
+`maggie-security` skill and `maggie security` command family (49 commands, 30
 MCP tools, 7 contracts under `contracts/maggie-security/`).
 
 - **Advisories for the whole stack.** Packages (npm, pnpm, Yarn, Bun,
@@ -856,8 +858,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.59 update --scope project --project . --force
-npx @topy-ai/maggie@0.7.59 cleanup --scope project --project .
+npx @topy-ai/maggie@0.7.61 update --scope project --project . --force
+npx @topy-ai/maggie@0.7.61 cleanup --scope project --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never

package/bundled-skills/maggie-security/SKILL.md

@@ -50,7 +50,7 @@ Follow [Maggie Memory Hook](../../references/memory-hook.md) at invocation and c
 | "are we being attacked / were we hacked?" | `maggie security logs-traffic --file access.log`, `maggie security logs-sigma --file access.log`, `maggie security logs-ioc --file access.log`; servers: `maggie security logs-remote --ssh web1=user@host` | `security_logs_check` |
 | "is my server hardened?" | `maggie security host-quick --ssh web1=user@host` (or `--print-collector` for the person to run), `maggie security host-nginx-config --ssh web1=user@host`, deep: `maggie security host-audit --ssh web1=user@host` | `security_host_check` |
 | "protect my server" (CrowdSec / fail2ban / Cloudflare) | `maggie security protect-plan --host web1 [--engine crowdsec\|fail2ban]` → the person reviews and runs it under the host lock; afterwards `maggie security protect-plan verify --plan FILE --ssh web1=user@host` | `security_protect_plan` |
-| "give me the fixes to run" | after the checks: `maggie security fix-plan --script fix.sh --output RUNBOOK.md` — a reviewed runbook (file permissions, firewall, apt updates, intrusion prevention, nginx, EOL) built from the findings; the person reviews it and runs it themselves under the host lock. Maggie never applies it. | — |
+| "give me the fixes to run" | after the checks: `maggie security fix-plan --script fix.sh --output RUNBOOK.md` — a reviewed runbook (file permissions, firewall, apt updates, intrusion prevention, nginx, EOL) built from the findings, each action tagged with a fix-risk tier T1–T4 (T1 batch-safe → T3 validate+auto-rollback → T4 stage-first/accepted-risk) so the operator knows what is safe to batch vs what must be tested first; the person reviews it and runs it themselves under the host lock. Maggie never applies it. Run `maggie security host-impact` first so the plan is blast-radius-aware (which services a patch affects, what must restart, whether a reboot is pending). | — |
 | "monitor uptime / tell me when the site is down" | `maggie security uptime-init` (verified domains) → `maggie security uptime-deploy --hostname status.example.com` (plan) → `maggie security uptime-status --gatus URL`; jobs report with `maggie security uptime-push` | `security_uptime_status` |
 | "how do we compare to OWASP?" / "threat model" | `maggie security checklist --level 1`, `maggie security threat-model --include-findings` | `security_checklist_get`, `security_threat_model` |
 | "is this npm package safe to add?" | `maggie security preinstall PKG[@VERSION]` before installing (W5); never install on `block` | `security_package_vet` |

package/bundled-skills/maggie-security/references/commands.md

@@ -91,6 +91,7 @@ Formats: nginx/Apache combined and vcombined, Caddy JSON, Cloudflare Logpush JSO
 | `maggie security host-quick --ssh web1=user@host \| --evidence FILE \| --print-collector` | SSH, firewall, automatic updates, fail2ban/CrowdSec and port alignment, databases listening publicly, Docker bypassing UFW, SUID, sudo logging, disk/memory; checks ported from vps-audit (MIT) | ssh-read |
 | `maggie security host-nginx-config --ssh web1=user@host \| --evidence FILE` | nginx -T and php -i rules: hidden files, PHP in uploads, PATH_INFO, old TLS/weak ciphers, HSTS, add_header inheritance, WordPress login limits, xmlrpc, key permissions | ssh-read |
 | `maggie security host-audit --ssh web1=user@host \| --evidence report.dat` | lynis (GPL, external) uploaded to a private /tmp folder under the host lock, removed afterwards (verified); hardening index and warnings | ssh-temp-write |
+| `maggie security host-impact --ssh web1=user@host \| --evidence FILE \| --print-collector` | patch **blast radius** (read-only): which pending updates are security-only (`apt-get -s upgrade` origin parsing) vs not, which running services still use pre-update libraries and must restart (`needrestart -b` — a patched library in memory is still the old one until restart), whether a reboot is pending (`/var/run/reboot-required` + kernel comparison), and the port→process map. Writes `inventory/impact.json`, which `fix-plan` reads to sharpen its risk tiers and restart steps. Techniques ported from PatchMon (MIT). | ssh-read |
 | `maggie security incident start\|log\|close\|show\|list` | timeline for a CVE response; `report --kind incident` prints it | none |
 
 ## Protect and assure
@@ -122,5 +123,5 @@ Formats: nginx/Apache combined and vcombined, Caddy JSON, Cloudflare Logpush JSO
 | Command | What it does |
 |---|---|
 | `maggie security report --kind weekly\|daily_ops\|incident\|gate [--audience owner\|technical] [--save]` | Markdown + JSON report from the latest runs; `--save` writes the `report_save` payload |
-| `maggie security fix-plan [--priority p0..p4] [--script fix.sh] [--output RUNBOOK.md]` | a reviewed remediation runbook from the open findings: grouped by category (file permissions, firewall, package/apt updates, intrusion prevention, web-server config, EOL), each step the commands the findings themselves carry (never invented). Writes a shell script you run yourself, under `maggie deployment host-lock`, after a backup and with a second SSH session open. Maggie never applies it. |
+| `maggie security fix-plan [--priority p0..p4] [--script fix.sh] [--output RUNBOOK.md]` | a reviewed remediation runbook from the open findings: grouped by category (file permissions, firewall, package/apt updates, intrusion prevention, web-server config, EOL), each step the commands the findings themselves carry (never invented). Every action is tagged with a **fix-risk tier** (T1 batch-safe distro/permission fixes → T2 restart+smoke-test → T3 config hardening that validates and auto-rolls-back → T4 major/EOL moves that are NOT auto-applied and are emitted as accepted-risk drafts to stage first); the apt batch backs up package state and verifies afterwards. If `host-impact` has run, the plan also shows the **blast radius** (which services each patch affects, what must restart, whether a reboot is pending) and its apt verify step restarts the services still running pre-update libraries. Writes a shell script you run yourself, under `maggie deployment host-lock`, after a backup and with a second SSH session open. Maggie never applies it. |
 | `maggie security mcp [--tools p0\|all] [--print-config claude\|codex]` | local stdio MCP server |

package/bundled-tools/clis/maggie_security_host.py

@@ -215,6 +215,125 @@ def host_quick(ctx: core.Context):
     return ctx.finish(findings, covered=[f"host:{host}", "*"])
 
 
+# --------------------------------------------------------------------------- host-impact (patch blast-radius)
+
+# The blast-radius collector answers "how big is the impact of patching X on this
+# host?" — the input the fix-risk tiers need to judge a patch against what is
+# actually running. Read-only. Techniques ported from PatchMon (apt security
+# simulate + origin parsing; /var/run/reboot-required + kernel comparison;
+# needrestart for the patched-but-not-restarted gap).
+IMPACT_COLLECTOR = r"""set +e
+s() { printf '\n### %s\n' "$1"; }
+SUDO=""; [ "$(id -u)" != 0 ] && sudo -n true 2>/dev/null && SUDO="sudo -n"
+s os-release; cat /etc/os-release 2>/dev/null
+s security-updates; LANG=C apt-get -s -o Debug::NoLocking=1 upgrade 2>/dev/null | grep '^Inst ' | head -300
+s reboot-required; [ -f /var/run/reboot-required ] && echo yes || echo no
+s reboot-pkgs; cat /var/run/reboot-required.pkgs 2>/dev/null | head -50
+s kernel; uname -r; ls -1 /boot/vmlinuz-* 2>/dev/null | sed 's#.*/vmlinuz-##' | sort -V | tail -1
+s needrestart; $SUDO needrestart -b 2>/dev/null | grep -E '^NEEDRESTART-(KCUR|KEXP|KSTA|SVC):' | head -200
+s listen; ss -H -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null
+s running-services; systemctl list-units --type=service --state=running --no-legend 2>/dev/null | awk '{print $1}' | head -200
+s timers; systemctl list-timers --all --no-legend 2>/dev/null | awk '{print $NF}' | grep -v '^$' | head -60
+s cron; ls -1 /etc/cron.d /etc/cron.daily /etc/cron.hourly 2>/dev/null | grep -v ':$' | sort -u | head -40; $SUDO ls -1 /var/spool/cron/crontabs 2>/dev/null | head -20
+"""
+
+LISTEN_PROC_RE = re.compile(r'users:\(\("([^"]+)"')
+APT_INST_RE = re.compile(r"^Inst\s+(\S+)\s+(?:\[[^\]]*\]\s+)?\(\S+\s*([^)]*)\)")  # name, then the origin tail
+
+
+def parse_impact(sections: dict[str, str]) -> dict:
+    """Turn the collector sections into a patch blast-radius snapshot."""
+    def lines(name: str) -> list[str]:
+        return [l.strip() for l in sections.get(name, "").splitlines() if l.strip()]
+
+    security, pending = [], []
+    for line in lines("security-updates"):
+        m = APT_INST_RE.match(line)
+        if not m:
+            continue
+        name, origins = m.group(1), m.group(2) or ""
+        pending.append(name)
+        if "security" in origins.lower():  # only the origin tail — package names can contain "security"
+            security.append(name)
+
+    reboot = (sections.get("reboot-required", "").strip().lower().startswith("yes"))
+    reboot_pkgs = lines("reboot-pkgs")
+    kl = lines("kernel")
+    running_k = kl[0] if kl else None
+    latest_k = kl[1] if len(kl) > 1 else None
+
+    svc_restart, kcur, kexp, ksta = [], running_k, None, None
+    for line in lines("needrestart"):
+        tag, _, val = line.partition(":")
+        val = val.strip()
+        if tag == "NEEDRESTART-SVC":
+            svc_restart.append(val)
+        elif tag == "NEEDRESTART-KCUR":
+            kcur = val
+        elif tag == "NEEDRESTART-KEXP":
+            kexp = val
+        elif tag == "NEEDRESTART-KSTA":
+            ksta = val
+    if kexp and not latest_k:
+        latest_k = kexp
+    kernel_stale = bool(ksta == "3") or bool(running_k and latest_k and running_k != latest_k)
+
+    listening = []
+    for line in lines("listen"):
+        proc = LISTEN_PROC_RE.search(line)
+        addr = line.split()[3] if len(line.split()) > 3 else ""
+        port = addr.rsplit(":", 1)[-1] if ":" in addr else addr
+        if proc and port:
+            listening.append({"port": port, "process": proc.group(1)})
+
+    return {"schema": "maggie-security-impact.v1",
+            "reboot_required": reboot or kernel_stale, "reboot_pkgs": reboot_pkgs,
+            "kernel": {"running": kcur, "latest": latest_k, "stale": kernel_stale},
+            "services_need_restart": sorted(set(svc_restart)),
+            "security_updates": sorted(set(security)), "pending_updates": sorted(set(pending)),
+            "listening": listening, "running_services": lines("running-services"),
+            "timers": lines("timers"), "cron": lines("cron"),
+            "needrestart_available": bool(sections.get("needrestart", "").strip())}
+
+
+def impact_findings(ctx: core.Context, snapshot: dict, host: str) -> list[dict]:
+    findings: list[dict] = []
+    svcs = snapshot["services_need_restart"]
+    if svcs:
+        shown = ", ".join(svcs[:8]) + (f" (+{len(svcs) - 8} more)" if len(svcs) > 8 else "")
+        findings.append(check(
+            "hq-needs-restart", f"{len(svcs)} running service(s) still use pre-update libraries — restart needed", "medium",
+            "A library was updated on disk but these services are still running the old copy in memory, so the fix is not live yet. "
+            "Restart them (or reboot if the kernel changed).", host=host, ctx=ctx,
+            evidence=shown, steps=["sudo needrestart -r a   # review, then restart the services it lists"] +
+            [f"sudo systemctl restart {shlex.quote(s)}" for s in svcs[:8]]))
+    if snapshot["reboot_required"]:
+        why_pkgs = (": " + ", ".join(snapshot["reboot_pkgs"][:6])) if snapshot["reboot_pkgs"] else ""
+        kern = snapshot["kernel"]
+        detail = f"running {kern['running']}, installed {kern['latest']}" if kern.get("stale") and kern.get("latest") else why_pkgs
+        findings.append(check(
+            "hq-reboot-required", "The server needs a reboot to finish applying updates", "medium",
+            "A kernel or core library update is only fully applied after a reboot. Schedule one in a maintenance window.",
+            host=host, ctx=ctx, evidence=detail.strip(" :"),
+            steps=["# schedule a reboot in a maintenance window, then:", "sudo shutdown -r +1 'Maggie: applying security updates'"]))
+    return findings
+
+
+def host_impact(ctx: core.Context):
+    if ctx.args.print_collector:
+        return {"_raw": IMPACT_COLLECTOR}
+    text, host = evidence_text(ctx, IMPACT_COLLECTOR)
+    sections = parse_sections(text)
+    if not sections:
+        raise core.UsageError("the evidence has no '### section' blocks; run the collector from --print-collector")
+    snapshot = parse_impact(sections)
+    snapshot.update({"host": host, "collected_at": core.iso()})
+    core.write_json(ctx.state.path("inventory", "impact.json"), snapshot)
+    findings = impact_findings(ctx, snapshot, host)
+    ctx.run["inputs"].update({"host": host, "impact": "inventory/impact.json"})
+    return ctx.finish(findings, covered=[f"host:{host}", "*"])
+
+
 # --------------------------------------------------------------------------- host-audit (lynis report.dat)
 
 
@@ -540,4 +659,6 @@ COMMANDS = [
                  routine_safe=False),
     core.Command("host-nginx-config", "nginx and PHP configuration rules (hidden files, PHP in uploads, TLS, headers, rate limits)", [], _quick,
                  host_nginx_config),
+    core.Command("host-impact", "patch blast-radius: which pending updates are security-only, what needs restart/reboot, and what is running "
+                 "(read-only; feeds fix-plan's risk tiers)", [], _quick, host_impact),
 ]

package/bundled-tools/clis/maggie_security_mcp.py

@@ -73,7 +73,7 @@ SCHEMAS: dict[str, dict] = {
         "mode": {"enum": ["traffic", "attacks", "ioc"]}, "file": LOGFILE, "since": SINCE,
         "rules": {"type": "string", "pattern": r"^(web|proxy|emerging)(,(web|proxy|emerging))*$"}}},
     "security_host_check": {"type": "object", "required": ["host"], "additionalProperties": False, "properties": {
-        "host": ALIAS, "depth": {"enum": ["quick", "nginx"]}}},
+        "host": ALIAS, "depth": {"enum": ["quick", "nginx", "impact"]}}},
     "security_protect_plan": {"type": "object", "required": ["host"], "additionalProperties": False, "properties": {
         "host": ALIAS, "engine": {"enum": ["auto", "crowdsec", "fail2ban", "cloudflare"]}, "site_type": {"enum": ["wordpress", "php-app", "node-app", "static", "workers"]}}},
     "security_uptime_status": {"type": "object", "additionalProperties": False, "properties": {"window": {"enum": ["1h", "24h", "7d", "30d"]}}},
@@ -229,7 +229,7 @@ class Server:
                 argv += ["--rules", args["rules"]]
             return argv
         if name == "security_host_check":
-            command = "host-nginx-config" if args.get("depth") == "nginx" else "host-quick"
+            command = {"nginx": "host-nginx-config", "impact": "host-impact"}.get(args.get("depth"), "host-quick")
             return [command] if dry else [command, "--ssh", f"{args['host']}={self.host_target(args['host'])}"]
         if name == "security_protect_plan":
             argv = ["protect-plan", "--host", args.get("host", "web1"), "--engine", args.get("engine", "auto")]

package/bundled-tools/clis/maggie_security_report.py

@@ -15,6 +15,7 @@ from __future__ import annotations
 import argparse
 import json
 import re
+import shlex
 from pathlib import Path
 
 import maggie_security_core as core
@@ -546,6 +547,53 @@ def fix_category(finding: dict) -> str:
     return "other"
 
 
+# Fix-risk tiers answer "will this patch break something?", a separate axis from
+# "how urgent is the flaw?" (severity/KEV/EPSS). The operator uses both: a KEV
+# critical justifies a riskier tier sooner, but the tier decides HOW to apply it.
+FIX_TIERS = [
+    ("T1", "Safe to batch-apply",
+     "Distro security-only updates and file-permission fixes. ABI-stable within the release; very low breakage risk. Do these first."),
+    ("T2", "Apply, then restart and smoke-test",
+     "App package upgrades (no major-version change) and plan-only setups. Low–moderate risk: restart the affected service and check it serves."),
+    ("T3", "Apply one at a time — validate and auto-rollback",
+     "Config hardening (TLS, headers, firewall, vhosts). Changes behaviour; can break old clients or lock you out. Each step backs up, validates, and reverts on failure."),
+    ("T4", "Do NOT auto-apply — stage first",
+     "Major-version jumps and end-of-life moves. High compatibility risk. Test in staging, schedule a change window; record as accepted-risk until then."),
+]
+TIER_LABEL = {t: f"{t} — {name}" for t, name, _ in FIX_TIERS}
+TIER_ORDER = [t for t, _, _ in FIX_TIERS]
+
+
+def _is_major_jump(current: str | None, fixed: str | None) -> bool:
+    """A different leading integer between the installed and fixed version — the
+    semver signal for a breaking upgrade (nginx 1.x→2.x, OpenSSL 1.1→3.0, Node 18→22)."""
+    def major(v: str | None) -> str | None:
+        m = re.match(r"\D*(\d+)", v or "")
+        return m.group(1) if m else None
+    cm, fm = major(current), major(fixed)
+    return bool(cm and fm and cm != fm)
+
+
+def fix_tier(action: dict) -> str:
+    """Compatibility/reversibility tier T1–T4 for an action (see FIX_TIERS)."""
+    lead = action["lead"]
+    category = fix_category(lead)
+    if category == "end-of-life":
+        return "T4"
+    if category == "packages":
+        osfam = (action.get("ecosystem") or "").split(":")[0]
+        if osfam in ("Ubuntu", "Debian"):
+            return "T1"  # distro security pocket, ABI-stable within the release
+        if _is_major_jump((lead.get("affected") or {}).get("version"), action.get("fix_version")):
+            return "T4"  # app package with a breaking major-version jump
+        return "T2"
+    if category == "secrets-permissions":
+        return "T1"
+    if category in ("web-server", "firewall"):
+        return "T3"  # config change that alters behaviour / can lock you out
+    return "T2"
+
+
 def fix_commands(action: dict) -> tuple[list[str], list[tuple[str, str]], list[str]]:
     """(shell commands, (kind, snippet) paste-ins, TODO notes) faithfully from the lead finding."""
     lead = action["lead"]
@@ -557,6 +605,98 @@ def fix_commands(action: dict) -> tuple[list[str], list[tuple[str, str]], list[s
     return commands, snippets, todos
 
 
+# nginx directives valid in the http{} context can be dropped into conf.d; the
+# rest (location/proxy/add_header) must live in a server{} block.
+NGINX_HTTP_DIRECTIVES = {"ssl_protocols", "ssl_ciphers", "ssl_prefer_server_ciphers", "ssl_ecdh_curve",
+                         "ssl_session_tickets", "ssl_session_timeout", "ssl_dhparam", "server_tokens"}
+NGINX_FILE_RE = re.compile(r"(/etc/nginx/[\w./-]+\.conf)")
+
+
+def nginx_fix_block(actions: list[dict]) -> tuple[list[str], list[str]]:
+    """Runnable nginx fixes: a global drop-in for http-context directives, and a
+    snippet file + a guarded, reversible `include` for server-context ones."""
+    http_dirs: list[tuple[str, dict]] = []
+    server_by_file: dict[str, list[str]] = {}
+    manual: list[dict] = []
+    for action in actions:
+        rem = action["lead"].get("remediation") or {}
+        snippets = [s.get("text", "").strip() for s in (rem.get("snippets") or []) if s.get("text")]
+        if not snippets:
+            manual.append(action)
+            continue
+        tp = (action["lead"].get("target") or {}).get("path") or ""
+        match = NGINX_FILE_RE.search(tp) or NGINX_FILE_RE.search(action["lead"].get("title", ""))
+        vfile = match.group(1) if match else None
+        for text in snippets:
+            name = text.split()[0] if text.split() else ""
+            if name in NGINX_HTTP_DIRECTIVES:
+                http_dirs.append((text, action))
+            elif vfile:
+                server_by_file.setdefault(vfile, [])
+                if text not in server_by_file[vfile]:
+                    server_by_file[vfile].append(text)
+            else:
+                manual.append(action)
+    sh: list[str] = []
+    md: list[str] = []
+    if http_dirs:
+        directives = list(dict.fromkeys(d for d, _ in http_dirs))
+        fixes = "; ".join(dict.fromkeys(a["title"] for _, a in http_dirs))
+        body = "".join(d + "\n" for d in directives)
+        sh += [f"# Global TLS/hardening — fixes: {fixes}",
+               f"printf %s {shlex.quote(body)} | sudo tee /etc/nginx/conf.d/00-maggie-hardening.conf >/dev/null",
+               "sudo nginx -t && sudo systemctl reload nginx", ""]
+        md.append("- **nginx global hardening** → drop-in `/etc/nginx/conf.d/00-maggie-hardening.conf`: "
+                  + ", ".join(f"`{d}`" for d in directives))
+    for vfile, directives in server_by_file.items():
+        stem = re.sub(r"[^\w.-]", "_", re.sub(r"\.conf$", "", vfile.rsplit("/", 1)[-1]))
+        snip = f"/etc/nginx/snippets/maggie-{stem}.conf"
+        heredoc = "\n".join(directives)
+        sh += [f"# Harden {vfile} (backs up, validates, auto-reverts on error)",
+               f"sudo tee {snip} >/dev/null <<'MAGGIE_SNIP'",
+               heredoc,
+               "MAGGIE_SNIP",
+               f"sudo cp -a {shlex.quote(vfile)} {shlex.quote(vfile + '.maggie.bak')}",
+               f"sudo sed -i -E '/^[[:space:]]*server[[:space:]]*\\{{[[:space:]]*$/a\\    include {snip};' {shlex.quote(vfile)}",
+               f"sudo nginx -t && sudo systemctl reload nginx || {{ echo 'nginx test failed — reverting'; "
+               f"sudo cp -a {shlex.quote(vfile + '.maggie.bak')} {shlex.quote(vfile)}; sudo systemctl reload nginx; }}", ""]
+        md.append(f"- **nginx vhost hardening** (`{vfile}` via `{snip}` + guarded include): "
+                  + ", ".join(f"`{d}`" for d in directives))
+    for action in manual:
+        rem = action["lead"].get("remediation") or {}
+        sh += [f"# [{action['priority']}] {action['title']} — {action['why']}",
+               f"#   TODO (manual): {rem.get('summary') or action['how']}", ""]
+        md.append(f"- **{action['title']}** — {rem.get('summary') or action['how']} _(manual)_")
+    return sh, md
+
+
+def impact_summary_sh(impact: dict) -> list[str]:
+    """A blast-radius header for the runbook, from `host-impact`'s snapshot."""
+    svcs = impact.get("services_need_restart") or []
+    listening = impact.get("listening") or []
+    out = ["# =================== Blast radius (from host-impact) ===================",
+           f"# Pending updates: {len(impact.get('pending_updates') or [])} "
+           f"({len(impact.get('security_updates') or [])} security-only — safe to batch as T1).",
+           f"# Public-facing services (port -> process): "
+           + (", ".join(f"{l['port']}:{l['process']}" for l in listening[:8]) or "none detected") + ".",
+           f"# Needs restart after patching ({len(svcs)}): " + (", ".join(svcs[:8]) or "none") + ".",
+           f"# Reboot pending: {'YES — schedule a maintenance window' if impact.get('reboot_required') else 'no'}.",
+           "# A patch is not live in a running service until that service restarts (or the box reboots).", ""]
+    return out
+
+
+def impact_summary_md(impact: dict) -> list[str]:
+    svcs = impact.get("services_need_restart") or []
+    listening = impact.get("listening") or []
+    return ["## Blast radius (from `host-impact`)", "",
+            f"- **Pending updates:** {len(impact.get('pending_updates') or [])} "
+            f"({len(impact.get('security_updates') or [])} security-only → safe to batch as T1)",
+            "- **Public-facing services:** " + (", ".join(f"`{l['port']}:{l['process']}`" for l in listening[:8]) or "none detected"),
+            f"- **Needs restart after patching ({len(svcs)}):** " + (", ".join(f"`{s}`" for s in svcs[:8]) or "none"),
+            f"- **Reboot pending:** {'**YES** — schedule a maintenance window' if impact.get('reboot_required') else 'no'}",
+            "", "_A patch is not live in a running service until that service restarts (or the box reboots)._", ""]
+
+
 def fix_plan(ctx: core.Context) -> dict:
     args = ctx.args
     since = resolve_since(ctx, args.since)
@@ -570,6 +710,9 @@ def fix_plan(ctx: core.Context) -> dict:
     for action in actions:
         buckets[fix_category(action["lead"])].append(action)
 
+    impact_path = ctx.state.path("inventory", "impact.json")
+    impact = core.read_json(impact_path) if impact_path.is_file() else None
+
     host = next((f.get("target", {}).get("host") for f in actionable if (f.get("target") or {}).get("host")), None)
     lock_target = host or "<user@host>"
     sh: list[str] = [
@@ -582,25 +725,73 @@ def fix_plan(ctx: core.Context) -> dict:
         "#   2. opening a SECOND SSH session (so a bad sshd/firewall change cannot lock you out),",
         f"#   3. taking the change lock: maggie deployment host-lock acquire --host {lock_target} --purpose fix-plan",
         "# Package upgrades belong in a maintenance window. Test nginx with `nginx -t` before every reload.",
+        "#",
+        "# FIX-RISK TIERS (will this patch break something? — separate from how urgent the flaw is):",
+    ] + [f"#   {TIER_LABEL[t]}: {note}" for t, _, note in FIX_TIERS] + [
+        "# Recommended order: T1 first, then T2, then T3 one at a time; schedule T4 separately.",
         "set -euo pipefail",
         "",
     ]
     md: list[str] = [f"# Remediation runbook — {ctx.site}" + (f" ({host})" if host else ""), "",
                      "Generated by `maggie security fix-plan`. **Review before running — Maggie never runs these.** "
                      "Take a backup, keep a second SSH session open, and work under "
-                     f"`maggie deployment host-lock acquire --host {lock_target} --purpose fix-plan`.", ""]
+                     f"`maggie deployment host-lock acquire --host {lock_target} --purpose fix-plan`.", "",
+                     "**Fix-risk tiers** — how likely a patch is to break something (separate from how urgent the flaw is). "
+                     "Apply T1 first, then T2, then T3 one at a time; schedule T4 separately.", ""]
+    md += [f"- **{TIER_LABEL[t]}** — {note}" for t, _, note in FIX_TIERS] + [""]
+    if impact:
+        sh += impact_summary_sh(impact)
+        md += impact_summary_md(impact)
+    else:
+        sh += ["# Blast radius not collected. For a sharper plan — which services a patch affects, what",
+               "# must restart (a patched library in memory is still the old one until restart), and whether",
+               "# a reboot is pending — run:  maggie security host-impact --ssh "
+               + (f"{host}=<user@host>" if host else "<alias>=<user@host>"), ""]
+        md += ["> Run `maggie security host-impact` first for a blast-radius-aware plan "
+               "(which services each patch affects, what must restart, whether a reboot is pending).", ""]
+
     apt_packages: list[str] = []
     total = 0
+    tier_counts: dict[str, int] = {t: 0 for t in TIER_ORDER}
+    for action in actions:
+        tier_counts[fix_tier(action)] += 1
     for key, label, note in FIX_CATEGORIES:
         items = buckets.get(key) or []
         if not items:
             continue
         sh += [f"# =================== {label} ===================", f"# {note}", ""]
         md += [f"## {label}", f"_{note}_", ""]
+        if key == "web-server":
+            sh.append("# Tier: T3 — each fix below backs up, validates with `nginx -t`, and auto-reverts on error.")
+            sh.append("")
+            md.append(f"_Risk tier: **{TIER_LABEL['T3']}** — each fix validates and auto-reverts._")
+            md.append("")
+            block_sh, block_md = nginx_fix_block(items)
+            sh += block_sh
+            md += block_md
+            total += len(items)
+            continue
+        if key == "end-of-life":
+            sh.append(f"# Tier: {TIER_LABEL['T4']}. DO NOT run these as part of this script.")
+            sh.append("# Test each move in staging and schedule a change window. Until then, record an accepted risk:")
+            md.append(f"_Risk tier: **{TIER_LABEL['T4']}** — do not auto-apply. Stage first; record as accepted-risk until scheduled._")
+            md.append("")
+            for action in items:
+                total += 1
+                sh.append(f"# [{action['priority']}] {action['title']} — {action['why']}")
+                for fid in action["ids"]:
+                    sh.append(f"# maggie security ledger accept --id {fid} "
+                              f"--reason {shlex.quote(action['title'] + ' — major/EOL upgrade, staging first')}")
+                sh.append("")
+                md.append(f"- **{action['title']}** — {action['why']}")
+                md.append(f"  - accept until staged: `maggie security ledger accept --id {action['ids'][0]} --reason \"…\"`")
+            md.append("")
+            continue
         for action in items:
             total += 1
-            sh.append(f"# [{action['priority']}] {action['title']} — {action['why']}")
-            md.append(f"- **{action['title']}** — {action['why']}")
+            tier = fix_tier(action)
+            sh.append(f"# [{action['priority']}][{tier}] {action['title']} — {action['why']}")
+            md.append(f"- **[{tier}] {action['title']}** — {action['why']}")
             if key == "packages":
                 # Build the fix command ourselves; never copy the finding's step text
                 # (it reads "apt-get install --only-upgrade X  (fixed in Y)" — not valid shell).
@@ -630,11 +821,25 @@ def fix_plan(ctx: core.Context) -> dict:
         md.append("")
     if apt_packages:
         pkgs = " ".join(sorted(set(apt_packages)))
-        insert = ["# Apply available Ubuntu/Debian security updates for the affected packages:",
+        insert = ["# Tier: T1 — distro security updates are ABI-stable within the release; safe to batch.",
+                  "# Back up the package state first so you can roll back a bad upgrade:",
+                  'sudo dpkg --get-selections > "$HOME/maggie-pkg-state.$(date +%F).txt"',
                   "sudo apt-get update",
                   f"sudo apt-get install --only-upgrade {pkgs}",
                   "# Or apply all pending security updates at once:",
-                  "# sudo unattended-upgrade -d    # or: sudo apt-get upgrade", ""]
+                  "# sudo unattended-upgrade -d    # or: sudo apt-get upgrade",
+                  "# Verify nothing broke after upgrading (and restart services if the kernel/libc changed):",
+                  "systemctl list-units --state=failed --no-legend || true",
+                  "sudo nginx -t 2>/dev/null && echo 'nginx config ok' || true"]
+        # A patched library on disk is not live until the services using it restart.
+        svcs = (impact or {}).get("services_need_restart") or []
+        insert += ["# Make the fix live — a patched library in memory is still the old one until restart:",
+                   "sudo needrestart -r l   # list what is still running old code; -r a to act on it"]
+        insert += [f"sudo systemctl restart {s}" for s in svcs[:8]]
+        if (impact or {}).get("reboot_required"):
+            insert += ["# A reboot is pending (kernel/core library) — schedule it in a maintenance window:",
+                       "# sudo shutdown -r +1 'applying security updates'"]
+        insert += ["# If a service failed: downgrade the package (apt-get install pkg=<old>) or restore from the snapshot.", ""]
         anchor = sh.index("# =================== Package updates ===================") + 3
         sh[anchor:anchor] = insert
         md.append("### apt batch")
@@ -652,6 +857,7 @@ def fix_plan(ctx: core.Context) -> dict:
         out.write_text(runbook, encoding="utf-8")
     return {"schema": "maggie-security-fix-plan.v1", "site": ctx.site, "host": host, "generated_at": core.iso(),
             "actions": total, "apt_packages": sorted(set(apt_packages)),
+            "tiers": {t: tier_counts[t] for t in TIER_ORDER if tier_counts[t]},
             "script_path": str(args.script) if args.script else None,
             "note": "Review before running. Maggie never applies these changes.", "markdown": runbook}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.59",
+  "version": "0.7.61",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",