@nomix-ai/nomix-harness 0.2.5 → 0.2.6

package/dist/kernel/goal/lib/types/index.js

@@ -178,10 +178,10 @@ let GoalService = (() => {
             ctx.inject(['sessionProjections'], (projectionCtx) => {
                 projectionCtx.sessionProjections.register({
                     key: 'goal',
-                    schema: goalProjectionSchema,
+                    stateSchema: goalProjectionSchema,
                     init: () => null,
                     apply: applyGoalProjection,
-                    view: state => state,
+                    wire: { viewSchema: goalProjectionSchema, view: state => state },
                     stateVersion: 4,
                 });
             });

package/dist/kernel/goal/lib/types/types.d.ts

@@ -83,6 +83,9 @@ export interface GoalProjection {
     readonly updatedAt: number;
 }
 declare module '@nomix-ai/nomix-session-projection/types' {
+    interface SessionProjectionStateMap {
+        goal: GoalProjection | null;
+    }
     interface SessionProjectionMap {
         /**
          * The session's current goal (the latest `goal/change` whole value), or

package/dist/kernel/goal/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-goal",
   "description": "Event-sourced same-session goal state and lifecycle service for the Nomix Harness",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/goal-round-driver/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-goal-round-driver",
   "description": "Race-fenced same-session goal-round driver",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/headless/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-headless",
   "description": "The nomix one-shot bundle: a direct core Agent/Session runner over nomix-base with no Host, HTTP, or browser layer",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/home-paths/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-home-paths",
   "description": "Shared filesystem path helpers for the Nomix Harness",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/hook-protocol/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-hook-protocol",
   "description": "Shared Claude Code / Codex hook wire protocol: matcher engine, stdin/exit-code/stdout codec, multi-hook merge, and hook/* session events",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/hooks-claude-code/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-hooks-claude-code",
   "description": "Bridge plugin: run a Claude Code hooks.json / settings hook config on the Nomix Harness interception seams",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/hooks-codex/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-hooks-codex",
   "description": "Bridge plugin: run a Codex hooks.json hook config on the Nomix Harness interception seams",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/host-apiproxy/lib/index.js

@@ -2,10 +2,12 @@ import { Service } from "../../cordis/lib/index.js";
 import z from "../../schemastery/lib/index.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, stat } from "node:fs/promises";
+import { homedir, release } from "node:os";
 import { dirname, extname } from "node:path";
+import { z as z$1 } from "zod";
 import { installModelSelection } from "../../agent/lib/index.js";
-import { AttachmentError } from "../../attachment/lib/index.js";
-import { ReasoningEffortId, contentHasImage, createUserMessage, errorChain, freezeMessage } from "../../llm/lib/index.js";
+import { AttachmentError, admitEncodedImages } from "../../attachment/lib/index.js";
+import { ReasoningEffortId, createUserMessage, errorChain, freezeMessage } from "../../llm/lib/index.js";
 import { isAppendSurfaceEvent, isJsonValue } from "../../session/lib/index.js";
 import { SessionQueryError } from "../../session-query/lib/index.js";
 import { SubagentError } from "../../subagent/lib/index.js";
@@ -17,11 +19,9 @@ import { GoalError } from "../../goal/lib/index.js";
 import { SettingsConflictError, settingsNamespace } from "../../settings/lib/index.js";
 import { credentialRef } from "../../credentials/lib/index.js";
 import { SessionTitleInvalidError } from "../../session-title/lib/index.js";
-import { z as z$1 } from "zod";
 import { UserQuestionError } from "../../user-questions/lib/index.js";
 import { DirectoryPickerError } from "../../host-directory-picker/lib/index.js";
 import { API_REMOTE_FORWARDED_EVENTS, ApiRemoteSessionNotFound, ApiRemoteSubagentSessionOwnership, apiRemoteSubagentOwnershipError, createApiRemoteAgentResolver, hasApiRemoteSubagentOwner, inspectApiRemoteSession } from "../../api-remotes/lib/index.js";
-import { release } from "node:os";
 import { runNativeCommand } from "../../native-command/lib/index.js";
 //#region lib/types/session-export.js
 /**
@@ -564,6 +564,7 @@ const imageLimitsProjectionSchema = z$1.object({
 	maxImagesPerMessage: z$1.number().int().positive(),
 	maxMessageImageBytes: z$1.number().int().positive(),
 	maxImagePixels: z$1.number().int().positive(),
+	maxImageDimension: z$1.number().int().positive(),
 	mediaTypes: z$1.array(z$1.string())
 });
 /** session.history response value (projections rides the tail page only). */
@@ -883,47 +884,21 @@ const COLD_SUMMARY_BATCH_SIZE = 16;
 const DEFAULT_COLD_BLANK_PROBE_MAX_BYTES = 1024;
 /** Conversation message event types (the pagination counting unit). */
 const MESSAGE_TYPES = new Set(["user/message", "assistant/message"]);
-/** Decode the browser payload while rejecting non-canonical base64 forms. */
-function decodeBase64(data) {
-	const decoded = Buffer.from(data, "base64");
-	if (data.length === 0 || decoded.toString("base64") !== data) throw new AttachmentError("Image upload is not canonical base64.", "INVALID_IMAGE_BASE64");
-	return new Uint8Array(decoded);
-}
 /** Validate one prompt as a batch before publishing any durable image object. */
 async function durablePromptContent(ctx, content) {
 	if (content.every((part) => part.type === "text")) return content.map((part) => ({
 		type: "text",
 		text: part.text
 	}));
-	const prepared = content.map((part) => part.type === "text" ? part : {
-		part,
-		data: decodeBase64(part.data)
+	const refs = await admitEncodedImages(ctx.attachments, content.filter((part) => part.type === "image"));
+	let next = 0;
+	return content.map((part) => part.type === "text" ? {
+		type: "text",
+		text: part.text
+	} : {
+		type: "image",
+		attachment: refs[next++]
 	});
-	const images = prepared.filter((part) => "data" in part);
-	const refs = await ctx.attachments.saveImages(images.map((image) => ({
-		data: image.data,
-		mediaType: image.part.mediaType,
-		...image.part.name === void 0 ? {} : { name: image.part.name }
-	})));
-	const blocks = [];
-	let imageIndex = 0;
-	for (const item of prepared) {
-		if (!("data" in item)) {
-			blocks.push({
-				type: "text",
-				text: item.text
-			});
-			continue;
-		}
-		const attachment = refs[imageIndex++];
-		/* v8 ignore next -- each prepared image supplied exactly one saveImages input and therefore one ordered ref. */
-		if (attachment === void 0) throw new Error("attachment batch result did not preserve input cardinality");
-		blocks.push({
-			type: "image",
-			attachment
-		});
-	}
-	return blocks;
 }
 /** Search durable content for an image reference, including nested tool results. */
 function imageBlockIn(content, match) {
@@ -956,10 +931,6 @@ function imageInEvent(event, match) {
 	}
 	if (event.type === "assistant/chunk" && data.chunk?.type === "block-end") return imageBlockIn([data.chunk.block], match);
 }
-/** True when the current model-visible surface contains an image. */
-function messagesHaveImage(messages) {
-	return messages.some((message) => contentHasImage(message.content));
-}
 /** Resolve the first reference matching one opaque id. */
 function referencedImage(events, attachmentId) {
 	for (const event of events) {
@@ -1824,23 +1795,29 @@ function createApiProxy(ctx, defaults) {
 	ctx.inject(["sessionProjections"], (projectionCtx) => {
 		projectionCtx.sessionProjections.register({
 			key: "sessionListMetadata",
-			schema: sessionListMetadataProjectionSchema,
+			stateSchema: sessionListMetadataProjectionSchema,
 			init: () => ({
 				blank: true,
 				lastPromptAt: null
 			}),
 			apply: applySessionListMetadata,
-			view: (state) => state,
+			wire: {
+				viewSchema: sessionListMetadataProjectionSchema,
+				view: (state) => state
+			},
 			stateVersion: 1
 		});
 	});
 	ctx.inject(["sessionProjections", "attachments"], (projectionCtx) => {
 		projectionCtx.sessionProjections.register({
 			key: "imageLimits",
-			schema: imageLimitsProjectionSchema,
+			stateSchema: z$1.null(),
 			init: () => null,
 			apply: (state) => state,
-			view: () => projectionCtx.attachments.imageLimits,
+			wire: {
+				viewSchema: imageLimitsProjectionSchema,
+				view: () => projectionCtx.attachments.imageLimits
+			},
 			stateVersion: 1
 		});
 	});
@@ -2627,17 +2604,6 @@ function createApiProxy(ctx, defaults) {
 							model,
 							...reasoningEffort === void 0 ? {} : { reasoningEffort: ReasoningEffortId(reasoningEffort) }
 						});
-						if ([...found.agent.inbox.nextTurn, ...found.agent.inbox.nextStep].some((message) => contentHasImage(message.content)) || messagesHaveImage(found.agent.session.deriveMessages())) {
-							const info = await ctx.llm.resolveModelInfo(resolved.provider, resolved.model);
-							if (info.inputModalities !== void 0 && !info.inputModalities.includes("image")) return err(request, {
-								code: "model-unavailable",
-								message: `Model "${resolved.model}" does not accept image input, but this session already contains images; select an image-capable model.`,
-								details: {
-									provider,
-									model
-								}
-							});
-						}
 						const selected = {
 							provider: resolved.provider,
 							model: resolved.model,
@@ -3146,6 +3112,7 @@ function createApiProxy(ctx, defaults) {
 					provider: selection.provider,
 					model: selection.model,
 					attachedSessions: ctx.agents.list().length,
+					home: homedir(),
 					canOpenPath: canOpenPaths()
 				}));
 			},
@@ -4156,6 +4123,7 @@ const hostDescribeValueSchema = z$1.object({
 	provider: z$1.string().optional(),
 	model: z$1.string().optional(),
 	attachedSessions: z$1.number().int().nonnegative(),
+	home: z$1.string(),
 	canOpenPath: z$1.boolean()
 });
 /** host.pickDirectory request payload (empty object literal). */

package/dist/kernel/host-apiproxy/lib/types/api/host.d.ts

@@ -37,6 +37,7 @@ export interface HostApi {
      * applied when a new agent doesn't specify them explicitly, absent when the host configures
      * no explicit default (the adapter falls back internally);
      * attachedSessions = count of currently attached sessions (those with a live agent);
+     * home = the host account home directory (Web display abbreviation on POSIX);
      * canOpenPath = whether this deployment can hand a path to a user-visible native desktop.
      */
     describe(request: RpcRequest<{}>): Promise<RpcResponse<{
@@ -45,6 +46,7 @@ export interface HostApi {
         provider?: string;
         model?: string;
         attachedSessions: number;
+        home: string;
         canOpenPath: boolean;
     }>>;
     /**

package/dist/kernel/host-apiproxy/lib/types/api/host.schema.d.ts

@@ -11,6 +11,7 @@ export declare const hostDescribeValueSchema: z.ZodObject<{
     provider: z.ZodOptional<z.ZodString>;
     model: z.ZodOptional<z.ZodString>;
     attachedSessions: z.ZodNumber;
+    home: z.ZodString;
     canOpenPath: z.ZodBoolean;
 }, z.core.$strip>;
 /** host.pickDirectory request payload (empty object literal). */

package/dist/kernel/host-apiproxy/lib/types/api/host.schema.js

@@ -11,6 +11,7 @@ export const hostDescribeValueSchema = z.object({
     provider: z.string().optional(),
     model: z.string().optional(),
     attachedSessions: z.number().int().nonnegative(),
+    home: z.string(),
     canOpenPath: z.boolean(),
 });
 /** host.pickDirectory request payload (empty object literal). */

package/dist/kernel/host-apiproxy/lib/types/api/sessions.d.ts

@@ -12,6 +12,10 @@ import type { RpcId, RpcRequest, RpcResponse } from './rpc.ts';
 import type { ToolEventView } from './events.ts';
 import type { WorkspaceId } from './workspace.ts';
 declare module '@nomix-ai/nomix-session-projection/types' {
+    interface SessionProjectionStateMap {
+        sessionListMetadata: SessionListMetadata;
+        imageLimits: null;
+    }
     interface SessionProjectionMap {
         /**
          * Session-list hints persisted by the projection cache. `blank: false`

package/dist/kernel/host-apiproxy/lib/types/api/sessions.schema.js

@@ -177,6 +177,7 @@ export const imageLimitsProjectionSchema = z.object({
     maxImagesPerMessage: z.number().int().positive(),
     maxMessageImageBytes: z.number().int().positive(),
     maxImagePixels: z.number().int().positive(),
+    maxImageDimension: z.number().int().positive(),
     mediaTypes: z.array(z.string()),
 });
 /** session.history response value (projections rides the tail page only). */

package/dist/kernel/host-apiproxy/lib/types/api-proxy.js

@@ -4,10 +4,12 @@
  */
 import { randomUUID } from 'node:crypto';
 import { mkdir, stat } from 'node:fs/promises';
+import { homedir } from 'node:os';
 import { dirname } from 'node:path';
+import { z as zod } from 'zod';
 import { installModelSelection } from '../../../agent/lib/index.js';
-import { AttachmentError } from '../../../attachment/lib/index.js';
-import { contentHasImage, createUserMessage, freezeMessage, ReasoningEffortId } from '../../../llm/lib/index.js';
+import { AttachmentError, admitEncodedImages } from '../../../attachment/lib/index.js';
+import { createUserMessage, freezeMessage, ReasoningEffortId } from '../../../llm/lib/index.js';
 import { errorChain } from '../../../llm/lib/index.js';
 import { isAppendSurfaceEvent, isJsonValue } from '../../../session/lib/index.js';
 import { SessionQueryError } from '../../../session-query/lib/index.js';
@@ -45,42 +47,17 @@ const COLD_SUMMARY_BATCH_SIZE = 16;
 export const DEFAULT_COLD_BLANK_PROBE_MAX_BYTES = 1024;
 /** Conversation message event types (the pagination counting unit). */
 const MESSAGE_TYPES = new Set(['user/message', 'assistant/message']);
-/** Decode the browser payload while rejecting non-canonical base64 forms. */
-function decodeBase64(data) {
-    const decoded = Buffer.from(data, 'base64');
-    if (data.length === 0 || decoded.toString('base64') !== data) {
-        throw new AttachmentError('Image upload is not canonical base64.', 'INVALID_IMAGE_BASE64');
-    }
-    return new Uint8Array(decoded);
-}
 /** Validate one prompt as a batch before publishing any durable image object. */
 async function durablePromptContent(ctx, content) {
     if (content.every(part => part.type === 'text')) {
         return content.map(part => ({ type: 'text', text: part.text }));
     }
-    const prepared = content.map(part => part.type === 'text'
-        ? part
-        : { part, data: decodeBase64(part.data) });
-    const images = prepared.filter((part) => 'data' in part);
-    const refs = await ctx.attachments.saveImages(images.map(image => ({
-        data: image.data,
-        mediaType: image.part.mediaType,
-        ...image.part.name === undefined ? {} : { name: image.part.name },
-    })));
-    const blocks = [];
-    let imageIndex = 0;
-    for (const item of prepared) {
-        if (!('data' in item)) {
-            blocks.push({ type: 'text', text: item.text });
-            continue;
-        }
-        const attachment = refs[imageIndex++];
-        /* v8 ignore next -- each prepared image supplied exactly one saveImages input and therefore one ordered ref. */
-        if (attachment === undefined)
-            throw new Error('attachment batch result did not preserve input cardinality');
-        blocks.push({ type: 'image', attachment });
-    }
-    return blocks;
+    const refs = await admitEncodedImages(ctx.attachments, content.filter(part => part.type === 'image'));
+    let next = 0;
+    return content.map(part => part.type === 'text'
+        ? { type: 'text', text: part.text }
+        // admitEncodedImages returns one reference per image part in order.
+        : { type: 'image', attachment: refs[next++] });
 }
 /** Search durable content for an image reference, including nested tool results. */
 function imageBlockIn(content, match) {
@@ -126,10 +103,6 @@ function imageInEvent(event, match) {
     }
     return undefined;
 }
-/** True when the current model-visible surface contains an image. */
-function messagesHaveImage(messages) {
-    return messages.some(message => contentHasImage(message.content));
-}
 /** Resolve the first reference matching one opaque id. */
 function referencedImage(events, attachmentId) {
     for (const event of events) {
@@ -1016,10 +989,10 @@ export function createApiProxy(ctx, defaults) {
     ctx.inject(['sessionProjections'], (projectionCtx) => {
         projectionCtx.sessionProjections.register({
             key: 'sessionListMetadata',
-            schema: sessionListMetadataProjectionSchema,
+            stateSchema: sessionListMetadataProjectionSchema,
             init: () => ({ blank: true, lastPromptAt: null }),
             apply: applySessionListMetadata,
-            view: state => state,
+            wire: { viewSchema: sessionListMetadataProjectionSchema, view: state => state },
             stateVersion: 1,
         });
     });
@@ -1039,10 +1012,10 @@ export function createApiProxy(ctx, defaults) {
     ctx.inject(['sessionProjections', 'attachments'], (projectionCtx) => {
         projectionCtx.sessionProjections.register({
             key: 'imageLimits',
-            schema: imageLimitsProjectionSchema,
+            stateSchema: zod.null(),
             init: () => null,
             apply: state => state,
-            view: () => projectionCtx.attachments.imageLimits,
+            wire: { viewSchema: imageLimitsProjectionSchema, view: () => projectionCtx.attachments.imageLimits },
             stateVersion: 1,
         });
     });
@@ -1943,18 +1916,6 @@ export function createApiProxy(ctx, defaults) {
                                 ? {}
                                 : { reasoningEffort: ReasoningEffortId(reasoningEffort) },
                         });
-                        const pendingImage = [...found.agent.inbox.nextTurn, ...found.agent.inbox.nextStep]
-                            .some(message => contentHasImage(message.content));
-                        if (pendingImage || messagesHaveImage(found.agent.session.deriveMessages())) {
-                            const info = await ctx.llm.resolveModelInfo(resolved.provider, resolved.model);
-                            if (info.inputModalities !== undefined && !info.inputModalities.includes('image')) {
-                                return err(request, {
-                                    code: 'model-unavailable',
-                                    message: `Model "${resolved.model}" does not accept image input, but this session already contains images; select an image-capable model.`,
-                                    details: { provider, model },
-                                });
-                            }
-                        }
                         const selected = {
                             provider: resolved.provider,
                             model: resolved.model,
@@ -2595,6 +2556,7 @@ export function createApiProxy(ctx, defaults) {
                     provider: selection.provider,
                     model: selection.model,
                     attachedSessions: ctx.agents.list().length,
+                    home: homedir(),
                     canOpenPath: canOpenPaths(),
                 }));
             },

package/dist/kernel/host-apiproxy/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-host-apiproxy",
   "description": "API gateway: the ApiProxy contract (api/), the fetch carrier pair (fetch/), and the host-side gateway plugin providing ctx.apiProxy",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/host-directory-picker/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-host-directory-picker",
   "description": "Abstract workspace-directory picking seam (ctx.directoryPicker) for the Nomix Harness web GUI host",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/host-directory-picker-auto/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-host-directory-picker-auto",
   "description": "Adaptive chooser of the directory-picker seam: resolves the host situation at boot and mounts the native or browse backend for the Nomix Harness web GUI host",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/host-directory-picker-browse/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-host-directory-picker-browse",
   "description": "In-app browsing backend of the directory-picker seam (listing/creation primitives over the host filesystem)",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/host-directory-picker-native/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-host-directory-picker-native",
   "description": "Native-OS-chooser backend of the directory-picker seam for the Nomix Harness web GUI host",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/host-frontend-static/lib/index.js

@@ -4,14 +4,14 @@ import z from "../../schemastery/lib/index.mjs";
 //#region lib/types/index.js
 /**
 * @nomix-ai/nomix-host-frontend-static — SPA dist server over the webserver
-* fallback seat: serves the built frontend directory with the semantics the
-* Web shell locked at step1 — traversal outside the dist root is 403, any
-* miss falls back to index.html with HTTP 200 (SPA routing), unknown
-* extensions ship as octet-stream, non-GET/HEAD is 405. Every index response
-* runs through the webserver's registered index taps (boot-manifest
-* injection). The dist location is workspace knowledge of the composing
-* application, so `distIndex` is typically supplied through a `!!js`
-* expression, never hardcoded by a deployment.
+* fallback seat: serves the built frontend directory with explicit index
+* entry points. A readable index renders at the dist root and configured index
+* path; missing paths return 404, traversal outside the dist root is 403,
+* unknown extensions ship as octet-stream, and non-GET/HEAD is 405. Every
+* index response runs through the webserver's index render (structured
+* injection rows, then raw taps). The dist location is workspace knowledge of
+* the composing application, so `distIndex` is typically supplied through a
+* `!!js` expression, never hardcoded by a deployment.
 * @module @nomix-ai/nomix-host-frontend-static
 */
 /** Stable Cordis plugin name. */
@@ -19,8 +19,9 @@ const name = "frontend-static";
 /** Service required before the fallback seat can be claimed. */
 const inject = ["webServer"];
 const Config = z.object({ distIndex: z.string().required() });
+const HTML_MIME = "text/html; charset=utf-8";
 const MIME = {
-	".html": "text/html; charset=utf-8",
+	".html": HTML_MIME,
 	".js": "text/javascript; charset=utf-8",
 	".css": "text/css; charset=utf-8",
 	".svg": "image/svg+xml",
@@ -28,14 +29,19 @@ const MIME = {
 	".map": "application/json",
 	".webmanifest": "application/manifest+json"
 };
+const STATIC_MISS_CODES = new Set([
+	"ENOENT",
+	"EISDIR",
+	"ENOTDIR"
+]);
 /**
 * Serve one GET/HEAD static request from the dist root.
 * @param pathname - decoded URL pathname of the request.
 * @param res - the node:http response to write.
 * @param distRoot - absolute dist root directory (resolved by the caller).
 * @param distIndex - absolute path of index.html inside distRoot.
-* @param renderIndex - produces the index.html body (index-tap injection) for
-* `/` and every SPA fallback.
+* @param renderIndex - produces the index.html body (structured injection
+* rendering) for the dist root and configured index path.
 */
 async function serveStatic(pathname, res, distRoot, distIndex, renderIndex) {
 	const target = resolve(normalize(join(distRoot, pathname)));
@@ -44,22 +50,24 @@ async function serveStatic(pathname, res, distRoot, distIndex, renderIndex) {
 		res.end();
 		return;
 	}
-	const serveIndex = async () => {
-		const body = await renderIndex();
-		res.writeHead(200, { "content-type": MIME[".html"] });
-		res.end(body);
-	};
-	if (target === distRoot || target === distIndex) {
-		await serveIndex();
-		return;
-	}
+	let body;
+	let type;
 	try {
-		const body = await readFile(target);
-		res.writeHead(200, { "content-type": MIME[extname(target)] ?? "application/octet-stream" });
-		res.end(body);
-	} catch {
-		await serveIndex();
+		if (target === distRoot || target === distIndex) {
+			body = await renderIndex();
+			type = HTML_MIME;
+		} else {
+			body = await readFile(target);
+			type = MIME[extname(target)] ?? "application/octet-stream";
+		}
+	} catch (error) {
+		if (!STATIC_MISS_CODES.has(error.code)) throw error;
+		res.writeHead(404);
+		res.end();
+		return;
 	}
+	res.writeHead(200, { "content-type": type });
+	res.end(body);
 }
 /**
 * Claim the webserver fallback seat and serve the dist.
@@ -69,7 +77,7 @@ async function serveStatic(pathname, res, distRoot, distIndex, renderIndex) {
 function apply(ctx, config) {
 	const distIndex = config.distIndex;
 	const distRoot = dirname(distIndex);
-	const renderIndex = async () => ctx.webServer.applyIndexTaps(await readFile(distIndex, "utf8"));
+	const renderIndex = async () => ctx.webServer.renderIndex(await readFile(distIndex, "utf8"));
 	ctx.effect(() => ctx.webServer.registerFallback(async (req, res) => {
 		if (req.method !== "GET" && req.method !== "HEAD") {
 			res.writeHead(405);

package/dist/kernel/host-frontend-static/lib/types/index.d.ts

@@ -1,13 +1,13 @@
 /**
  * @nomix-ai/nomix-host-frontend-static — SPA dist server over the webserver
- * fallback seat: serves the built frontend directory with the semantics the
- * Web shell locked at step1 — traversal outside the dist root is 403, any
- * miss falls back to index.html with HTTP 200 (SPA routing), unknown
- * extensions ship as octet-stream, non-GET/HEAD is 405. Every index response
- * runs through the webserver's registered index taps (boot-manifest
- * injection). The dist location is workspace knowledge of the composing
- * application, so `distIndex` is typically supplied through a `!!js`
- * expression, never hardcoded by a deployment.
+ * fallback seat: serves the built frontend directory with explicit index
+ * entry points. A readable index renders at the dist root and configured index
+ * path; missing paths return 404, traversal outside the dist root is 403,
+ * unknown extensions ship as octet-stream, and non-GET/HEAD is 405. Every
+ * index response runs through the webserver's index render (structured
+ * injection rows, then raw taps). The dist location is workspace knowledge of
+ * the composing application, so `distIndex` is typically supplied through a
+ * `!!js` expression, never hardcoded by a deployment.
  * @module @nomix-ai/nomix-host-frontend-static
  */
 import type { ServerResponse } from 'node:http';
@@ -29,8 +29,8 @@ export declare const Config: z<Config>;
  * @param res - the node:http response to write.
  * @param distRoot - absolute dist root directory (resolved by the caller).
  * @param distIndex - absolute path of index.html inside distRoot.
- * @param renderIndex - produces the index.html body (index-tap injection) for
- * `/` and every SPA fallback.
+ * @param renderIndex - produces the index.html body (structured injection
+ * rendering) for the dist root and configured index path.
  */
 export declare function serveStatic(pathname: string, res: ServerResponse, distRoot: string, distIndex: string, renderIndex: () => Promise<string>): Promise<void>;
 /**