fimo 0.0.0 → 0.2.1-experimental.1781864090656

package/README.md

@@ -0,0 +1,344 @@
+# fimo
+
+Fimo project CLI **and** library. One npm package, three surfaces:
+
+- `fimo` binary — `fimo create`, `fimo deploy`, `fimo switch`, …
+- `fimo/ui` — React runtime (providers, components, `useTranslations`).
+- `fimo/vite` — Vite plugin that composes Fimo's build-time plugins and auto-regenerates the schema/form TS clients.
+
+## Using the library inside a Fimo project
+
+```jsonc
+// package.json (scaffolded by `fimo create`)
+{
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview",
+  },
+  "dependencies": { "fimo": "^0.0.1", "react": "...", "react-router": "..." },
+  "devDependencies": { "vite": "...", "oxlint": "...", "typescript": "..." },
+}
+```
+
+```ts
+// vite.config.ts
+import { defineConfig } from 'vite';
+import { fimo } from 'fimo/vite';
+export default defineConfig({ plugins: [fimo()] });
+```
+
+```ts
+// src/main.tsx
+import { AppRoutesProvider } from 'fimo/ui';
+```
+
+The vite plugin:
+
+- Injects `fimo-config.json` constants as build-time defines.
+- Registers the SEO, data-id, overlay, preview-script, and translations plugins.
+- Watches `src/{schemas,forms}/**/*.json` and regenerates the corresponding `.ts` clients on change. No separate prebuild script needed.
+
+## Running the CLI during dev
+
+```sh
+# from the monorepo root
+pnpm -F fimo start -- <command>
+# e.g.
+pnpm -F fimo start -- login
+pnpm -F fimo start -- create my-site
+pnpm -F fimo start -- deploy --publish
+pnpm -F fimo start -- invite
+pnpm -F fimo start -- referral link
+pnpm -F fimo start -- referral stats
+```
+
+## Install `fimo` as a global command
+
+```sh
+# from the monorepo root
+pnpm install-cli
+```
+
+That one command:
+
+1. Builds the CLI (three-way tsc build for `dist/{cli,ui,vite,scripts}`).
+2. Makes `apps/cli/dist/cli/index.js` executable.
+3. Creates a symlink at `~/.local/bin/fimo` pointing at the built entry.
+4. Warns if `~/.local/bin` is not on your `PATH`.
+
+Add `~/.local/bin` to your shell rc if the script warned you:
+
+```sh
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+Verify:
+
+```sh
+fimo --help
+```
+
+After that `fimo create my-site`, `fimo deploy`, etc. work from any directory.
+
+> The symlink points at the built entry inside the monorepo, so after `git pull` just re-run `pnpm install-cli` (or `pnpm -F cli build`) to refresh — the symlink itself stays valid.
+
+### Why this works anywhere
+
+- The **project template** lives at `apps/cli/templates/<framework>/` (currently just `react-router/`) and the **`.claude/` starter** lives under `apps/cli/assets/agents-starter/`. The CLI resolves both relative to its own file location (via `import.meta.url`, see `apps/cli/src/runtime/templates.ts`). There is no cross-package runtime path — `fimo` needs nothing outside the CLI package.
+- The scaffolded homepage is intentionally a single-page starter so `fimo create` produces something visible and editable immediately, rather than a blank screen.
+- That homepage is intentionally disposable. Real generations should replace its content/style instead of iterating on the default Fimo-branded design. Run `fimo check-starter` against a generated project to catch leaked starter copy.
+
+## Previewing the scaffold without `fimo create`
+
+- The source for the scaffolded project is checked in at `apps/cli/templates/react-router/`, so you can inspect the exact files that `fimo create` copies without creating a project first.
+- There is not currently a dedicated one-command preview flow for that template inside the monorepo. To render it as a website, you still need to run the template itself or scaffold a project from it.
+
+## Environment variables
+
+| Variable       | Default                 | Purpose                                                                                      |
+| -------------- | ----------------------- | -------------------------------------------------------------------------------------------- |
+| `FIMO_API_URL` | `http://localhost:3000` | Base URL of the Fimo HTTP API (management + tenant). Point at staging/prod to test remotely. |
+| `FIMO_WEB_URL` | `http://localhost:5173` | Base URL of the Fimo web app. The login flow opens `<FIMO_WEB_URL>/auth/cli` in the browser. |
+
+### Pointing the CLI at another environment (staging, prod, preview)
+
+Export both vars before running any command so login, API calls, and the browser callback all target the same environment:
+
+```sh
+export FIMO_API_URL="<staging-api-base-url>"
+export FIMO_WEB_URL="<staging-web-base-url>"
+
+fimo login
+fimo create my-staging-site
+```
+
+Credentials are scoped per-backend (hashed on `apiUrl`). `fimo login` writes to `~/.config/fimo/credentials/<host>-<hash>.json`; switching `FIMO_API_URL` and re-running `fimo login` writes a fresh slot without disturbing the old one.
+
+## Active organization
+
+`fimo login` automatically persists your personal org (or the first org you belong to) as the **active organization** in `credentials.json`. `fimo create` uses it — no prompt.
+
+To switch:
+
+```sh
+fimo switch
+```
+
+`fimo whoami` prints the currently active organization. `fimo create --org <id>` still works for one-off overrides.
+
+## Envs (M07 — branch = env)
+
+Every project has one or more **envs** (`main`, `feat/seo`, `release/v1.4.2`, …). Each `fimo` command auto-targets the env from the **current git branch**, falling back to `main` when there's no branch:
+
+```sh
+git checkout feat/seo
+fimo cms entries list BlogPost   # → env: feat/seo (from git branch)
+
+git checkout main
+fimo cms entries list BlogPost   # → env: main (from git branch)
+```
+
+A `release/<tag>` checkout maps to the well-known `prod` shorthand and is **read-only** — mutating commands refuse to run:
+
+```sh
+git checkout release/v1.4.2
+fimo cms entries create BlogPost --body '{...}'  # ✗ refuses (read-only env 'prod')
+fimo cms entries list BlogPost                   # ok (read-only)
+```
+
+### Override with `--env <name>`
+
+The `--env` root flag overrides the auto-target for one invocation:
+
+```sh
+fimo --env staging cms entries list BlogPost
+fimo --env release/v1 cms entries get BlogPost the-launch-day
+```
+
+The CLI prints a one-line banner on stderr so you can see what env each command targeted:
+
+```
+→ env: staging (from --env)
+```
+
+Behind the scenes the CLI sends `X-Fimo-Env: <env>` on every request; the server's `resolveEnv` middleware picks it up. Branch and override names are validated client-side against the canonical regex (`/^[a-zA-Z0-9._/-]+$/`, ≤255 chars).
+
+### Common errors
+
+| Error                                                   | Hint                                                                          |
+| ------------------------------------------------------- | ----------------------------------------------------------------------------- |
+| `You are not in a Fimo project.`                        | `cd` into a directory containing `.fimo.settings.json`, or run `fimo create`. |
+| `In a git repository but no branch could be detected …` | Detached HEAD — `git checkout main` or pass `--env <name>`.                   |
+| `--env value '...' is invalid`                          | Env names must match `/^[a-zA-Z0-9._/-]+$/` and not start with `-`.           |
+| `Env '...' not found on the server.`                    | `fimo branch` to list envs; `fimo branch <name>` to create one.               |
+
+## Git-shaped CLI (M08)
+
+The `fimo` command set mirrors git's shape — same verbs, multi-surface semantics:
+
+```sh
+fimo branch                          # list envs (current marked with *)
+fimo branch -v                       # + show archived + preview URLs
+fimo branch feat/seo                 # create env off current
+fimo branch -d feat/old              # archive (refuses if unmerged)
+fimo branch -D feat/old              # force-delete
+fimo branch -m feat/typo feat/fixed  # rename
+
+fimo checkout feat/seo               # switch env + git branch
+fimo checkout -b feat/new            # create + switch
+
+fimo switch feat/seo                 # alias for `fimo checkout`
+fimo organizations switch            # (the old `fimo switch` org switcher moved here)
+
+fimo pull                            # sync current env from parent
+fimo pull --from main                # explicit parent override
+
+fimo diff                            # current vs main, across all surfaces
+fimo diff feat/seo main              # explicit
+fimo diff --surface schemas          # filter to one surface
+fimo diff --surface code             # drops to `git diff` locally
+fimo diff --json                     # raw JSON for pipes/agents
+
+fimo merge feat/seo                  # multi-surface merge (refuses on main)
+fimo merge feat/seo --allow-direct-merge   # override the protected-flow gate
+fimo merge feat/seo -y               # parent-wins for every conflict
+
+fimo status                          # the showcase: 8 surfaces in one report
+fimo status --short                  # one line per surface
+fimo status --vs main                # explicit comparison target
+fimo status --code --content         # surface filters (any combo)
+fimo status --json                   # raw JSON
+
+fimo publish --version 1.4.2         # tag release/v1.4.2 + trigger prod swap
+
+fimo agents list                     # (M13 stub — full impl lands with the agent system)
+```
+
+### Surfaces
+
+Every multi-surface command spans the same 8 surfaces in the same canonical order:
+
+```
+code · schemas · content · translations · routes · assets · forms · activations
+```
+
+The renderer prints them grouped, with `+` (added) / `-` (removed) / `~` (changed) / `!` (conflict) glyphs and a dim summary line per section. Each surface check has a 2 s soft timeout — a slow surface renders as `(surface check timed out)` and the rest of the report still draws.
+
+### Protected flow
+
+`fimo merge` refuses to merge directly onto `main` by default. Use the PR/review flow, or pass `--allow-direct-merge` to override (useful for cutover-style operator work). `fimo publish` similarly requires you to already be on `main`.
+
+### `NO_COLOR` / `--no-color`
+
+The CLI honors the [NO_COLOR](https://no-color.org/) standard. Every multi-surface command also accepts a per-invocation `--no-color` flag for piping into tools that don't strip ANSI escapes.
+
+## Inviting users
+
+`fimo invite` opens an interactive flow that mirrors the UI sharing dialogs:
+
+- choose whether to invite someone to an **organization** or a **project**
+- enter the invitee email
+- pick the organization role (`member`, `admin`, `owner`) or project access level (`view`, `comment`, `edit`, `full`)
+
+Examples:
+
+```sh
+# interactive
+fimo invite
+
+# invite to the active organization
+fimo invite --target organization --email jane@acme.com --role admin
+
+# invite to the current project from .fimo.settings.json
+fimo invite --target project --email jane@acme.com --role edit
+
+# invite to a specific project
+fimo invite --target project --project <projectId> --email jane@acme.com --role full
+```
+
+## Referral link
+
+Use `fimo referral link` to print your public referral link directly in the terminal:
+
+```sh
+fimo referral link
+```
+
+The command uses the current signed-in user and prints a shareable URL like:
+
+```text
+https://fimo.ai/invite/<your-user-id>
+```
+
+## Referral stats
+
+Use `fimo referral stats` to print the same referral summary exposed in the UI:
+
+```sh
+fimo referral stats
+```
+
+It shows:
+
+- total referrals
+- signed up referrals
+- activated referrals
+- AI credits earned
+
+## Publishing a test tarball (R2)
+
+The CLI ships as a single self-contained tarball (template + compiled JS). For internal distribution we upload it to a Cloudflare R2 bucket via `wrangler`.
+
+```sh
+# from apps/cli
+pnpm publish-cli
+# or from anywhere:
+pnpm -F fimo publish-cli
+```
+
+What this does:
+
+1. `pnpm -F fimo build` → compiles TS and refreshes the bundled template.
+2. `pnpm pack` → produces `apps/cli/fimo-<version>.tgz` (~175 KB).
+3. `wrangler r2 object put` → uploads it to `r2://<bucket>/cli/fimo-<version>.tgz` **and** `r2://<bucket>/cli/fimo-latest.tgz`.
+
+### Env vars
+
+| Variable                | Default         | Purpose                    |
+| ----------------------- | --------------- | -------------------------- |
+| `FIMO_CLI_R2_BUCKET`    | `fimo-cli-test` | Target R2 bucket name      |
+| `CLOUDFLARE_API_TOKEN`  | —               | wrangler auth (standard)   |
+| `CLOUDFLARE_ACCOUNT_ID` | —               | wrangler account selection |
+
+### Overrides
+
+```sh
+# different bucket
+FIMO_CLI_R2_BUCKET=fimo-cli-staging pnpm -F fimo publish-cli
+
+# upload to the local wrangler dev store instead of the real R2 (dry-run style)
+pnpm -F fimo publish-cli -- --local
+```
+
+### Installing the tarball on a test machine
+
+The test bucket is publicly served at **`https://pub-41cdea46386f4b238d8c528c4327dfc1.r2.dev`**.
+
+```sh
+# always-latest
+npm install -g https://pub-41cdea46386f4b238d8c528c4327dfc1.r2.dev/cli/fimo-latest.tgz
+
+# pin a specific version
+npm install -g https://pub-41cdea46386f4b238d8c528c4327dfc1.r2.dev/cli/fimo-0.0.1.tgz
+
+fimo --help
+```
+
+Interactive global installs ask whether to run `fimo skills install` so the user's AI coding tools can load the Fimo skills immediately. Non-interactive installs, CI, and `FIMO_SKIP_POSTINSTALL_PROMPT=1` skip the prompt and print the manual command instead. The installer also prints `fimo login` as the next account step, but it does not open the browser login flow from `postinstall`.
+
+> `publish-cli` uploads both `cli/fimo-<version>.tgz` and `cli/fimo-latest.tgz` on every run.
+
+## Credentials
+
+Stored at `${XDG_CONFIG_HOME:-~/.config}/fimo/credentials/<host>-<hash>.json` (one file per backend). Each file contains the access token, user info, and the active organization. Delete the file (or run `fimo login` against a new `FIMO_API_URL`) to switch accounts.

package/assets/agent-templates/_default/GOAL.md

@@ -0,0 +1,11 @@
+# Agent goal
+
+Describe what this agent should do. The whole of GOAL.md is the agent's
+prompt — there's no frontmatter or structured fields, just plain English.
+
+Some good things to include:
+
+- The end state you want when the agent succeeds
+- Inputs the agent should expect (CLI args, files, API responses)
+- Anything the agent should **not** do
+- The format of the report / output the agent should produce

package/assets/agent-templates/_default/config.yaml

@@ -0,0 +1,4 @@
+# Minimum-viable config. Add triggers / composition / data_sources as needed.
+# See https://fimo.dev/docs/agents/bundle for the full reference.
+version: 1
+description: 'A new Fimo agent. Edit this tagline to describe what it does.'

package/assets/agent-templates/broken-link-sweeper/GOAL.md

@@ -0,0 +1,51 @@
+# Broken-link sweeper
+
+Crawl the project's published site once a week, find every broken link
+(404s on internal routes, dead external destinations), classify them by
+the page they live on, and propose a per-page fix on its own branch.
+
+## Inputs
+
+- The project's `sitemap.xml`, fetched from the published origin.
+- Each page's HTML, fetched fresh on every run.
+- The project's analytics (read-only) — used to rank which pages to
+  triage first when the broken-link count is large.
+
+## What to do
+
+1. Fetch `sitemap.xml` and enumerate the canonical URL set.
+2. For each URL, fetch the HTML and collect every `<a href>` plus every
+   `<link rel="canonical">` and every `<img src>` target.
+3. Classify each link:
+   - **internal-404** — same-origin route that returns 4xx.
+   - **external-dead** — third-party host that returns 4xx/5xx or
+     times out after a reasonable retry.
+   - **internal-redirect** — internal route that 301s to a different
+     path (worth flagging, not always worth fixing).
+4. Group findings by the source page that contains them.
+5. For each affected page, open a fresh branch off `main` and commit a
+   draft fix:
+   - **internal-404** → propose a route alias or update the link to the
+     closest live route (if the analytics show traffic to the dead path,
+     prefer the alias; otherwise update in place).
+   - **external-dead** → remove the link and replace its anchor text
+     with plain text, leaving a TODO comment for a human to revisit.
+   - **internal-redirect** → update the link to the canonical target.
+6. Open one `agent_branch_proposal` per affected page so the owner can
+   review each batch independently.
+
+## What to produce
+
+- One branch per affected page, named `agent/broken-links/<page-slug>`.
+- One proposal per branch summarising the findings and the fix.
+- A single run report at `reports/broken-links-<YYYY-MM-DD>.md` with
+  the overall counts, the top 5 dead external destinations, and a
+  trend footer (`<!-- agent-summary: ... -->`) for diffing across
+  runs.
+
+## What NOT to do
+
+- Don't merge any branch — every fix goes through human review.
+- Don't follow `noindex` or `disallow`'d routes; respect the project's
+  robots policy.
+- Don't fetch a URL more than once per run, and back off on 5xx.

package/assets/agent-templates/broken-link-sweeper/capabilities.yaml

@@ -0,0 +1,6 @@
+- net:fetch
+- files:read
+- files:write
+- git:branch
+- git:commit
+- fimo:analytics:read

package/assets/agent-templates/broken-link-sweeper/config.yaml

@@ -0,0 +1,12 @@
+version: 1
+description: 'Crawl the published site and flag broken outbound links in a weekly report.'
+
+runtime:
+  cloud: true
+  long_running: true
+
+triggers:
+  - type: manual
+  - type: schedule
+    cron: '0 4 * * MON'
+    tz: UTC

package/assets/agent-templates/content-translator/GOAL.md

@@ -0,0 +1,37 @@
+# Content translator
+
+Translate CMS entries from the project's default locale into every
+non-default locale declared in `fimo.config.json`. Writes go through
+the `agent` branch and never directly to `main` — the M19 lifecycle
+engine picks the branch up and either auto-merges or proposes it for
+review.
+
+## Inputs
+
+- The list of CMS entries that have a non-empty default-locale field
+  but an empty translation for any non-default locale.
+- The configured target locales (read from `fimo.config.json`).
+
+## What to do
+
+For each entry:
+
+1. Read the default-locale field via `cms:read`.
+2. Translate to every missing locale (via `net:fetch` to your translation
+   provider of choice).
+3. Write the translation back to the entry via `cms:write`.
+4. Commit the change on the agent's branch.
+
+## What NOT to do
+
+- Don't translate fields that the entry's schema marks `translate: false`.
+- Don't overwrite an existing translation, even if it looks lower quality.
+- Don't auto-merge to main — the lifecycle engine will propose a PR
+  when `agents.auto_merge.enabled` is true and the diff classifies as
+  `low_risk` or `trivial`.
+
+## v1.x note
+
+Cloud-time activation of this agent requires
+`agents.notifications.email_recipients` to be non-empty (per ADR-0009).
+Add at least one address before running `fimo agents activate`.

package/assets/agent-templates/content-translator/capabilities.yaml

@@ -0,0 +1,10 @@
+# Reads CMS, writes translations + i18n + files. Net for the translation provider.
+- cms:read
+- cms:write
+- i18n:read
+- i18n:write
+- files:read
+- files:write
+- net:fetch
+- git:branch
+- git:commit

package/assets/agent-templates/content-translator/config.yaml

@@ -0,0 +1,11 @@
+version: 1
+description: 'Translate CMS content into the project locales whenever an entry is published.'
+data_sources:
+  - main
+
+# Trigger on every CMS publish event. The runtime debounces — multiple
+# publishes within ~30s collapse into a single agent run.
+triggers:
+  - type: manual
+  - type: event
+    event: cms.publish

package/assets/agent-templates/content-translator/scripts/translate-entries.ts

@@ -0,0 +1,66 @@
+/**
+ * Tool: translate-entries
+ *
+ * Walk every CMS entry, find translatable fields missing translations,
+ * call the configured translation provider, and write back through the
+ * Fimo API. Skips fields marked `translate: false` in the schema.
+ *
+ * Provider is configured via env (FIMO_AGENT_TRANSLATE_PROVIDER) — the
+ * runtime threads project secrets through when the v1.x secrets API
+ * lands. For now this template uses the OpenAI fallback.
+ */
+
+interface Entry {
+  id: string;
+  type: string;
+  data: Record<string, unknown>;
+}
+
+interface TranslateOptions {
+  fromLocale: string;
+  toLocales: string[];
+  api: { base: string; projectId: string; env: string };
+}
+
+async function listMissing(_opts: TranslateOptions): Promise<Entry[]> {
+  // Stub — wired to the Fimo API by the runtime. Returns entries with
+  // at least one non-default-locale field that's empty while the
+  // default-locale field is populated.
+  return [];
+}
+
+async function translate(text: string, _to: string): Promise<string> {
+  // Stub — call the configured provider. Returns the translated string.
+  return text;
+}
+
+async function writeBack(_entry: Entry, _locale: string, _value: string): Promise<void> {
+  // Stub — PATCH the entry via `/api/management/projects/:id/envs/:env/cms/:type/:id`.
+}
+
+async function main(): Promise<void> {
+  const fromLocale = process.env.FIMO_DEFAULT_LOCALE ?? 'en';
+  const toLocales = (process.env.FIMO_TARGET_LOCALES ?? '').split(',').filter(Boolean);
+  const api = {
+    base: process.env.FIMO_API_URL ?? 'http://localhost:3000',
+    projectId: process.env.FIMO_PROJECT_ID ?? '',
+    env: process.env.FIMO_ENV ?? 'main',
+  };
+
+  const entries = await listMissing({ fromLocale, toLocales, api });
+  for (const entry of entries) {
+    for (const locale of toLocales) {
+      const sourceValue = (entry.data[fromLocale] as Record<string, string> | undefined)?.title;
+      if (!sourceValue) {
+        continue;
+      }
+      const translated = await translate(sourceValue, locale);
+      await writeBack(entry, locale, translated);
+    }
+  }
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/assets/agent-templates/content-translator/scripts/write-locale-files.ts

@@ -0,0 +1,66 @@
+/**
+ * Tool: write-locale-files
+ *
+ * For locale-keyed JSON files in `src/locales/<locale>.json`, fill in
+ * missing keys from the default-locale file using the configured
+ * translation provider. Run after translate-entries when projects mix
+ * CMS-driven copy with hardcoded i18n strings.
+ */
+
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+interface Catalog {
+  [key: string]: string;
+}
+
+async function readCatalog(file: string): Promise<Catalog> {
+  try {
+    const text = await fs.readFile(file, 'utf8');
+    return JSON.parse(text) as Catalog;
+  } catch {
+    return {};
+  }
+}
+
+async function writeCatalog(file: string, catalog: Catalog): Promise<void> {
+  await fs.writeFile(file, JSON.stringify(catalog, null, 2) + '\n', 'utf8');
+}
+
+async function translate(text: string, _to: string): Promise<string> {
+  // Stub — provider-specific call.
+  return text;
+}
+
+async function main(): Promise<void> {
+  const defaultLocale = process.env.FIMO_DEFAULT_LOCALE ?? 'en';
+  const targetLocales = (process.env.FIMO_TARGET_LOCALES ?? '').split(',').filter(Boolean);
+  const localesDir = process.env.FIMO_LOCALES_DIR ?? 'src/locales';
+
+  const defaultFile = path.join(localesDir, `${defaultLocale}.json`);
+  const defaultCatalog = await readCatalog(defaultFile);
+
+  for (const target of targetLocales) {
+    const targetFile = path.join(localesDir, `${target}.json`);
+    const targetCatalog = await readCatalog(targetFile);
+    let dirty = false;
+
+    for (const [key, sourceValue] of Object.entries(defaultCatalog)) {
+      if (targetCatalog[key]) {
+        continue;
+      }
+      targetCatalog[key] = await translate(sourceValue, target);
+      dirty = true;
+    }
+
+    if (dirty) {
+      await writeCatalog(targetFile, targetCatalog);
+      console.log(`Wrote ${targetFile}`);
+    }
+  }
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/assets/agent-templates/post-deploy-check/GOAL.md

@@ -0,0 +1,23 @@
+# Post-deploy check
+
+Run a quick health probe every time the project deploys, and post a
+summary back to the deploy log. Triggered automatically by the
+`deploy.succeeded` event.
+
+## What to do
+
+1. Read the routes the deploy declares as critical (`probe-routes.ts`).
+2. For each one, fetch and assert that the response is 2xx and renders
+   the expected key element (a known DOM selector).
+3. Read the last 5 minutes of production logs (`check-logs.ts`) and
+   surface any errors emitted during the deploy window.
+4. Write a single-line summary to stdout that the deploy notification
+   includes verbatim. Examples:
+   - `✅ 12 routes pass · 0 errors`
+   - `❌ /pricing failed (500) · 3 errors in last 5min`
+
+## What NOT to do
+
+- Don't roll back the deploy — that's a separate human-in-the-loop
+  decision; this agent only reports.
+- Don't write to CMS or files. Read-only probes plus log reads.

package/assets/agent-templates/post-deploy-check/capabilities.yaml

@@ -0,0 +1,2 @@
+- net:fetch
+- fimo:logs:read

package/assets/agent-templates/post-deploy-check/config.yaml

@@ -0,0 +1,9 @@
+version: 1
+description: 'Probe routes and inspect logs after a deploy; report any issues to email recipients.'
+data_sources:
+  - prod
+
+triggers:
+  - type: manual
+  - type: webhook
+    path: deploy-done