fimo 2.8.0-staging.9 → 2.9.0-staging.1

package/assets/skills/fimo/SKILL.md

@@ -38,7 +38,6 @@ Pick by task:
 
 - Writing code — schemas/forms, generated clients, labels, framework adapters, rendering primitives → `fimo-code`
 - Site creation, local setup, cloning, and CLI workflows — init, push, deploy, sync, labels, domains, analytics → `fimo-cli`
-- Fimo agents — create, configure, validate, deploy, run, or inspect them → `fimo-cli` (`references/agents.md`)
 - AI agent setup — connect Claude Code, Codex, Cursor, or another agent → `fimo-cli` (`references/agent-setup.md`)
 - Remote MCP integrations — add, inspect, search, or run an MCP server → `fimo-cli` (`references/mcp.md`)
 - The Fimo Studio dashboard / web app UI → `fimo-studio`

package/assets/skills/fimo-cli/SKILL.md

@@ -3,13 +3,13 @@ name: fimo-cli
 description: >-
   Use the `fimo` CLI to create or operate a Fimo site: content, forms,
   media, labels/locales, deploys, Branches, Environments, domains, analytics,
-  integrations, Fimo agents, collaboration, accounts, and credits. Also use
+  integrations, collaboration, accounts, and credits. Also use
   for AI agent or MCP setup and confirmed Fimo platform blockers.
 ---
 
 # Fimo CLI
 
-The `fimo` CLI is the workflow surface for Fimo. Fimo connects content, media, forms, analytics, editing, and hosting to web applications. The CLI handles site creation, content / forms / media / labels / locale workflows, deploys, collaboration, account management, Fimo agents, AI credit inspection, and AI agent setup.
+The `fimo` CLI is the workflow surface for Fimo. Fimo connects content, media, forms, analytics, editing, and hosting to web applications. The CLI handles site creation, content / forms / media / labels / locale workflows, deploys, collaboration, account management, AI credit inspection, and AI agent setup.
 
 This skill describes **what the CLI does and the workflows it drives**. For the package surface used IN code (component props, generated hooks, JSON shapes, code-side rules), load the `fimo-code` skill on demand with `fimo skills get fimo-code`, using the invocation prefix below.
 
@@ -61,6 +61,8 @@ fimo skills install                            # install the global Fimo skill f
 fimo init my-site --org <id>                   # one-stop setup: sign in, create/link a project, install deps + skills. Use the org **id** from `fimo orgs list`, NOT the slug.
 fimo init my-react-site --framework react-router --org <id> --yes --no-skills  # canonical React Router template
 fimo init --project-id <id> my-site            # set up a project by ID: scaffold a newly created project or clone existing code
+fimo new my-site --yes --json                  # create a site without an account; a person claims it within 72 hours. Run `fimo new --instructions` for the full guide
+fimo claim --json                              # inside a `fimo new` site: the claim link and claim state
 fimo clone                                     # interactively choose an existing project to clone locally
 cd my-site                                     # then load skills on demand: fimo skills get fimo-code
 pnpm dev                                       # run the app locally (use the project's PM: pnpm/npm run/yarn/bun) — your iteration loop
@@ -101,7 +103,7 @@ Load the matching reference when the user's request fires its trigger. Recipes t
 - "Check the site in a browser / is my site accessible / a11y or WCAG check / measure LCP or Web Vitals / why is the page slow / inspect network requests or console errors / Lighthouse score" → `references/site-checks.md`
 - "Schedule a command / cron / nightly publish / recurring checks / `fimo schedules`" → `references/schedules.md`
 - "Set env vars / configure API keys / add project secrets / local `.env.local` / `fimo vars` / `fimo secrets`" → `references/project-vars-and-secrets.md`
-- "React to form submissions / publish changes / agent runs / analytics reports / media activity / send events to Resend, Slack, GitHub, Zapier, or an HTTP endpoint / configure or debug outbound webhooks" → `references/webhooks.md`
+- "React to form submissions / publish changes / analytics reports / media activity / send events to Resend, Slack, GitHub, Zapier, or an HTTP endpoint / configure or debug outbound webhooks" → `references/webhooks.md`
 - "Enable provider tools / integrations / API key connection for a provider / agent integration access" → `references/integrations.md`
 - "Firecrawl / scrape a public website / competitor research / agent web research" → `references/integrations.md` **+ load `references/integrations/firecrawl.md`**
 - "Check credits / credit balance / can I keep using AI / billing credits / running low / how many credits are left" → `references/credits.md`
@@ -114,7 +116,6 @@ Load the matching reference when the user's request fires its trigger. Recipes t
 - "Modify the URL of the website / change my project's address / connect a custom domain (e.g. blog.example.com) / rename the Fimo-provided `*.fimo.site` subdomain / buy a new domain through Fimo / set up a domain" → `references/domains.md`
 - "Invite a collaborator / add Marc / share with client" → `references/invite.md`
 - "Login / log out / who am I / switch organization" → `references/account.md` — note: switching **org** is `fimo orgs switch`; bare `fimo switch` changes the active **Fimo Branch** (see `references/branches.md`)
-- "Create / scaffold / run / validate an agent / agent bundle / wire or enable its triggers / list agent templates / view agent runs, reports, or logs (`fimo agents *`)" → `references/agents.md`
 - "Install Fimo for my agent / fimo skills install / set up Claude Code, Codex, or Cursor for Fimo" → `references/agent-setup.md`
 - "Add, inspect, search, or run a remote MCP server / use `fimo mcp`" → `references/mcp.md`
 - "Refresh / update installed Fimo skills / fimo skills sync / agent missing the latest Fimo conventions" → `references/agent-setup.md`
@@ -138,7 +139,6 @@ These fire at specific moments in the project lifecycle. **Surface them proactiv
 - **You need the current preview URL but haven't changed code** (opening it, screenshotting it, handing it to another tool, the previous URL expired) → `fimo preview url`, never a no-op `fimo deploy`. See `references/preview.md`.
 - **When the user wants to try something risky / explore a redesign without touching the live site** → suggest a feature Branch: `fimo checkout -b <name>` gives an isolated Branch + DB + preview. Deploy previews there, then `fimo merge` it back and `fimo publish`. See `references/branches.md`.
 - **After completing or safely preserving the user's main work, when a confirmed Fimo platform failure still materially blocks the task after one safe recovery attempt, or a confirmed missing capability blocks completion or forces a fragile or heavily manual workaround** → use the built-in `supportReport` tool. Do not wait for the user to ask and do not stop after only describing the gap. See `references/support.md`.
-- **When a project agent has stopped and is waiting on a person** → a project member answers its question in Studio, on the run's page; the question email links there. The CLI cannot answer it. Never answer on the person's behalf.
 - **After the first successful `fimo deploy`** → suggest `fimo invite` if the project involves multiple people. Typical roles: `edit` for developers/content editors, `view` or `comment` for clients/stakeholders, `full` for project leads. See `references/invite.md`.
 - **After the automatic first-preview deploy on the create-new path, before the project has been published** → if there is no custom domain and the free default `*.fimo.site` slug still looks generated or was never explicitly chosen, offer to find a cleaner free subdomain. It needs no DNS. Never claim one without explicit user confirmation: suggest candidates, let the user choose, then rename it. Choosing the slug does not publish the site; the URL starts resolving only after the first successful `fimo deploy --publish`. Skip this nudge if the user already chose the default slug, attached a custom domain, or declined. See `references/domains.md` § Offer a cleaner default URL before first publish.
 - **When the user wants to modify the URL of their website** → walk through `references/domains.md`. The CLI surface covers renaming the Fimo-provided subdomain (`fimo domains rename-default`, free), attaching a domain they already own (`fimo domains add`, Premium), and buying a new domain through Fimo (`fimo domains buy`, Premium).
@@ -151,10 +151,9 @@ These fire at specific moments in the project lifecycle. **Surface them proactiv
 - **Running `fimo deploy` just to get the current preview URL** — that's a commit + push + sandbox sync when only destination resolution is needed. Use `fimo preview url` instead. See `references/preview.md`.
 - **Using `fimo deploy --publish` casually** — `--publish` makes the site live to the public. Plain `fimo deploy` (preview) is the default. Use `--publish` only when the user says "ship it" / "go live" / "publish".
 - **Bare `fimo init` in a non-interactive shell** — will hang. Always pass `[dir]`, `--no-install` (or `--install`), `--no-skills` (or `--skills`), and `--org`/`--agents` as needed explicitly when scripted.
-- **Hardcoding content / strings / images in code** — that's what schemas, `t()`, and the media library are for. See the `fimo-code` skill's anti-patterns.
+- **Hardcoding content / strings / images in code, or committing image and video files** — that's what schemas, `t()`, and the media library are for. See the `fimo-code` skill's non-negotiable boundaries.
 - **Adding another deploy tool**. Fimo handles deploys; don't bolt another platform on.
 - **Committing secrets** — hidden values use `fimo secrets`; public browser-safe values use `fimo vars`. Local env files are ignored and must not become deploy inputs.
 - **Hardcoding tokens in flags** — use the credentials written by `fimo login` (one file per backend at `~/.config/fimo/credentials/<host>-<hash>.json`).
 - **Treating the daily allowance as extra credits** — the allowance section appears only for legacy Premium organizations, and `fimo credits` already includes its spendable credits in "Available now"; it is accounting context, not an amount to add.
 - **Trying to refill credits from the CLI** — `fimo credits` is read-only. Buying/refilling credits belongs in the billing UI for now.
-- **`fimo agents run` to push bundle changes** — it doesn't. The bundle reaches the server through `fimo deploy` (it lives in git, not the DB), and that push to `main` is also what wires the declared triggers. `run` dispatches the _deployed_ version. Deploy first. There is no `activate` command. See `references/agents.md`.

package/assets/skills/fimo-cli/references/assets.md

@@ -7,6 +7,8 @@ This file covers the **CLI workflow** for media that already exists: uploading f
 
 ## Upload a file
 
+Every image or video the site uses goes through this upload or a generation task, never into the repository. Run `fimo skills get fimo-code` and read § Non-negotiable boundaries for the rule and its exceptions.
+
 ```bash
 fimo assets upload ./hero.jpg
 fimo assets upload ./hero.jpg --name "Hero Image" --parent-id "<folder-uuid>"

package/assets/skills/fimo-cli/references/branches.md

@@ -83,12 +83,15 @@ fimo status --json           # machine-readable
 
 ```bash
 fimo merge feat/seo                   # merge feat/seo into the current Branch
-fimo merge feat/seo -y                # non-interactive: parent-wins on every conflict
+fimo merge feat/seo -y                # non-interactive: keep the target's value on every conflict
+fimo merge feat/seo --resume          # continue a stopped merge, or follow one still applying
 fimo merge feat/seo --allow-direct-merge   # override the "don't merge straight onto main" gate
 ```
 
 - Merging directly onto `main` is gated — the CLI refuses unless you pass `--allow-direct-merge`. Prefer merging on a branch and publishing.
-- On conflicts you get an interactive resolver per row: **parent** (keep the target's value), **child** (take the source's value), or **abort** (cancels the merge; the server runs compensating actions). `-y` accepts parent-wins for everything.
+- On conflicts nothing is applied. In a terminal you get a resolver per row: **parent** (keep the target's value), **child** (take the source's value), **pick** (edit in `$EDITOR`), or **abort**. `-y` keeps the target's value for everything.
+- `--json` never prompts. Unresolved conflicts exit non-zero with `MERGE_CONFLICTS`; `error.details` carries `merge_id`, `from`, `to`, and `conflicts`. Re-run with `--resume --yes` to keep the target's values, or resolve interactively.
+- After resolutions are accepted the CLI waits for the merge: success is `status: "ok"` with the completed merge's `mergeId` and `summary` but no `applied` list (per-surface counts are only reported when a merge applies cleanly without conflicts); `MERGE_FAILED` and `MERGE_CANCELLED` are terminal; `MERGE_IN_PROGRESS` means it is still applying — run `--resume` to keep following it. `--resume` never resubmits a merge that is already applying.
 
 ## `fimo pull`
 

package/assets/skills/fimo-cli/references/deploy.md

@@ -105,7 +105,7 @@ There's nothing special about this — it's the same `fimo deploy` you'd run lat
 **Use `--no-restart` when you only touched HMR-safe files:**
 
 - Anything under `src/**` (components, pages, hooks, styles)
-- Asset files under `public/` or `src/assets/`
+- Fixed-path static files under `public/`, such as favicons or `robots.txt` (images and videos belong in the media library, not the repository; see the `fimo-code` skill's non-negotiable boundaries)
 - Content / entries / translations / form definitions (JSON the Fimo runtime hot-loads)
 
 **Do NOT use `--no-restart` when you touched any of these — they require a fresh dev server:**

package/assets/skills/fimo-cli/references/hosting.md

@@ -33,31 +33,25 @@ Declare redirects, headers, rewrites, and URL shape in
 
 Every field is optional. Only what you declare is emitted.
 
-## Preview and security headers
-
-A restrictive application-owned CSP or `X-Frame-Options` policy can block Studio
-Preview. Do not assume automatic header rewriting; Next.js `withFimo` does not
-provide it. Inspect the served policy and scope any manual adaptation to Preview,
-preserving production protections and unrelated headers. `frame-ancestors`
-permits the Studio parent, not the framed app's preview origin. Never derive
-ancestor sources from a preview-origin variable. For `script-src`, `connect-src`,
-`frame-src`, and `form-action`, use resolved/observed Fimo resources and endpoints
-actually used by the iframe. Studio-parent WebSockets do not belong in app CSP.
-
 ## Matching
 
 `source` matches the pathname only, never the query string.
 
-| Pattern         | Matches                                |
-| --------------- | -------------------------------------- |
-| `/about`        | exactly that path                      |
-| `/blog/:slug`   | one segment, captured as `slug`        |
-| `/proxy/:rest*` | any number of segments, including none |
-| `/(.*)`         | everything                             |
+| Pattern         | Matches                                       |
+| --------------- | --------------------------------------------- |
+| `/about`        | exactly that path                             |
+| `/blog/:slug`   | one segment, captured as `slug`               |
+| `/proxy/:rest*` | any number of segments, including none        |
+| `/(.*)`         | everything                                    |
+| `/:path(.*)`    | everything, including `/`, captured as `path` |
 
 Captured names are reusable in `destination`: `/blog/:slug` →
 `/posts/:slug`. `destination` may be an absolute path or an external URL.
 
+Fimo preserves `source` as written. Use `/:path(.*)` when a redirect, rewrite,
+or header rule must include the homepage `/`; do not assume `/:path*` includes
+it. Keep `:path*` in the destination to reuse the captured path.
+
 ## Conditions
 
 Any redirect, rewrite, or header rule can require more than a path match. `has`
@@ -93,9 +87,15 @@ them are present.
 Omit `value` to match on presence alone, as the `consent` cookie above does.
 The redirect example requires the request to include `x-promo: summer`.
 
+For a www-to-apex redirect, connect both hostnames and use
+`{"source":"/:path(.*)","has":[{"type":"host","value":"www.example.com"}],"destination":"https://example.com/:path*","statusCode":301}`.
+The host condition matches the visitor's requested hostname. Verify `/`, a
+nested path, and a query string, and check that the destination host does not
+redirect back.
+
 **Prefer doing this in the application when it can.** Middleware, a loader, or a
-server component can be run and tested locally; a condition here only takes
-effect once published, so a mistake is found in production. Reach for `has` when
+server component can be run and tested locally; a condition here takes effect
+on hosted deployments and needs verification there. Reach for `has` when
 the app cannot act — a redirect that must happen before any code runs, or a
 header on a static asset.
 
@@ -121,6 +121,6 @@ header on a static asset.
 ## Verify
 
 `fimo validate` rejects an unknown `hosting` key, so a typo fails locally
-rather than silently doing nothing in production. Behaviour itself only takes
-effect once published — check the live URL after `fimo deploy --publish`, not
-the preview.
+rather than silently doing nothing in production. Hosting rules apply to
+hosted deployments; the sandbox dev server does not exercise them. Verify
+affected routes on the hosted preview and after an authorized publish.

package/assets/skills/fimo-cli/references/init.md

@@ -111,8 +111,7 @@ fimo link <projectId> --relink
 
 - The selected project shell: Next.js App Router by default, React Router with `--framework react-router`, a native React SPA with `--framework vite`, Astro with `--framework astro`, or SvelteKit with `--framework sveltekit`
 - `.fimo/project.json` — links this directory to the remote site (read-only after creation)
-- `.fimo/config.json` — project, optional Studio Pages route metadata, locale, SEO, and agent policy
-- `.fimo/agents/` — versioned agent bundles
+- `.fimo/config.json` — project, optional Studio Pages route metadata, locale, and SEO
 - `AGENTS.md` + `CLAUDE.md` — project rules (from the template) read by AGENTS.md-compatible tools and Claude Code. Both point the agent at `fimo skills get` to load the real skills on demand.
 - A git repository with `fimo` as the remote, and — after dependencies install — an initial commit (including the lockfile) plus an initial push
 

package/assets/skills/fimo-cli/references/integrations/firecrawl.md

@@ -134,45 +134,6 @@ Secrets and API keys are never returned. Do not call Firecrawl directly with an
 
 For users, describe monitors as website change monitors: create a monitor, list monitors, pause/resume/delete a monitor, check a monitor now, and view recent checks. Keep storage and cleanup mechanics out of user-facing responses.
 
-## Agent Access
-
-Project-level setup makes Firecrawl available to the project. Add Firecrawl to an agent's `config.yaml` to let that
-agent use it. If you omit `tools`, the agent gets every Firecrawl tool; use a tools map when you want a narrower set.
-
-```yaml
-integrations:
-  firecrawl:
-    enabled: true
-```
-
-Selective access:
-
-```yaml
-integrations:
-  firecrawl:
-    enabled: true
-    tools:
-      search: true
-      scrape: true
-      map: false
-      crawl: false
-      'monitor.list': true
-      'monitor.create': false
-```
-
-After editing agent config:
-
-```bash
-fimo validate
-fimo agents integrations seo-researcher
-```
-
-For deployed or scheduled agents, deploy the bundle after changing `.fimo/agents/<name>/config.yaml`:
-
-```bash
-fimo deploy
-```
-
 ## Ideal Agent Path
 
 1. Confirm the user wants public web inspection, not private data access.
@@ -187,8 +148,7 @@ fimo deploy
    - `crawl --limit <small>` to read several pages.
      Treat search excerpts as concise evidence for straightforward questions. Scrape the source for full context,
      exact quotations, implementation details, ambiguous claims, or high-stakes verification.
-7. For a project agent, update `integrations`, validate, preview with `fimo agents integrations <agent>`, then deploy.
-8. Keep findings in the agent report or task output; do not write scraped content into source files unless the user asks.
+7. Keep findings in the chat reply or task output; do not write scraped content into source files unless the user asks.
 
 ## Failure Modes
 

package/assets/skills/fimo-cli/references/integrations.md

@@ -16,7 +16,7 @@ fimo integrations status firecrawl
 
 `info` shows supported auth choices, required credentials, tools, and recipes. For a built-in service the only auth choice is `fimo`. `status` shows the project-specific setup state.
 
-When running inside an autonomous agent session, `fimo integrations list` shows the effective integrations available to that agent runtime, scoped by `.fimo/agents/<name>/config.yaml`. It lists only usable tools, plus the auth column and the config path that granted access.
+When running inside an agent session, `fimo integrations list` shows only the integrations the project has enabled for that session.
 
 ## Add a remote MCP server
 
@@ -91,40 +91,4 @@ does not change the project default integration setup, and built-in services hav
 
 Firecrawl `monitor.*` tools monitor websites for changes. `monitor.list` shows the website change monitors available in the current project. Fimo cleans up those monitors when the project is deleted.
 
-For Firecrawl-specific recipes, JSON examples, and agent policy guidance, load `references/integrations/firecrawl.md`.
-
-## Agent Access Policy
-
-Project integrations are enabled at the project level. An agent opts into an integration in
-`.fimo/agents/<name>/config.yaml` (or the legacy root `agents/<name>/config.yaml`):
-
-When `tools` is omitted, the agent can use every tool currently exposed by that integration. Add a `tools` map only
-when the agent needs a narrower set:
-
-```yaml
-integrations:
-  firecrawl:
-    enabled: true
-```
-
-For a narrower allowlist, add the tools explicitly:
-
-```yaml
-integrations:
-  firecrawl:
-    enabled: true
-    tools:
-      scrape: true
-      crawl: false
-      'monitor.list': true
-```
-
-If an integration is omitted or disabled, the agent cannot use it. If an explicit `tools` map has no `true` entries, it also grants no tools. With no map, newly available provider tools are included automatically on the next run.
-
-Run `fimo validate` after editing agent config to check local shape plus project-level integration setup.
-
-Preview one agent's local policy with:
-
-```bash
-fimo agents integrations seo-researcher
-```
+For Firecrawl-specific recipes and JSON examples, load `references/integrations/firecrawl.md`.

package/assets/skills/fimo-cli/references/knowledge.md

@@ -45,4 +45,4 @@ with `projectId`; update accepts `content`.
 
 Settings also offers **Draft from website**. It runs analysis in the background and returns an editable
 draft for review. Only an explicit **Save** updates shared knowledge; drafting does not grant permission
-to write it. Do not install an autonomous agent to perform this action.
+to write it.

package/assets/skills/fimo-cli/references/mcp.md

@@ -100,10 +100,10 @@ fimo mcp run sentry search_issues --input @request.json
 Omit `--input` when the tool takes no arguments. Use inline JSON, a project-relative `@file`, or `--input -` to read JSON
 from stdin.
 
-## Studio and project agents
+## Studio chat
 
-Remote MCP servers remain normal project integrations underneath the focused CLI. Studio chat and autonomous agents
-discover and run them through:
+Remote MCP servers remain normal project integrations underneath the focused CLI. Studio chat discovers and runs them
+through:
 
 ```bash
 fimo integrations list
@@ -111,9 +111,8 @@ fimo integrations info mcp_sentry
 fimo integrations run mcp_sentry search_issues --input '{"query":"open regressions"}'
 ```
 
-An autonomous agent only sees integrations enabled in its committed `integrations:` policy. Studio receives a frozen
-snapshot of the integrations enabled when the turn starts. Neither surface receives the underlying credential or opens
-a direct connection to the remote server.
+Studio receives a frozen snapshot of the integrations enabled when the turn starts. It never receives the underlying
+credential or opens a direct connection to the remote server.
 
 ## Supported servers
 

package/assets/skills/fimo-cli/references/preview.md

@@ -9,7 +9,7 @@ fimo preview url --branch main --json
 curl -L "$(fimo preview url)"
 ```
 
-The command returns the hosted deployment URL in every output mode, whatever the project's Preview setting says: every live Branch except production owns a hosted build.
+The command returns the hosted deployment URL in every output mode: every live Branch except production owns a hosted build.
 
 If the current generation is queued or building, the command waits up to five minutes, polling with a backoff. It stops at once — without waiting — on a state waiting cannot change: a build that failed, and a Branch with no hosted preview (production, or a Branch nothing has changed yet). Every failure returns `PREVIEW_URL_FAILED`; read `error.message` for which one it was and `error.hint` for the next step. Only the timeout is worth retrying.
 

package/assets/skills/fimo-cli/references/project-vars-and-secrets.md

@@ -55,23 +55,7 @@ and the active git branch; hosted preview and production inject it directly.
 
 Local env files are ignored by git in Fimo sites. They are for local development only; deployment reads project variables from Fimo and injects them into the remote build.
 
-## Agent Secrets
-
-Agents receive only the secrets they request in their own config.
-
-```bash
-fimo agents secrets add seo-publisher FIRECRAWL_API_KEY
-fimo agents secrets list seo-publisher
-fimo agents secrets remove seo-publisher FIRECRAWL_API_KEY
-fimo agents validate
-```
-
-`fimo agents secrets add` edits `.fimo/agents/<name>/config.yaml`. It does not create or rotate the secret value. Use `fimo secrets add` to create the value or `fimo secrets update` to rotate it.
-
-`fimo agents validate` checks that required agent secrets exist in the project. A running agent keeps the Branch it started with; the next run reads the deployed agent config again.
-
 ## Choosing Between Them
 
 - If the value can safely be visible in browser code or page source, use `fimo vars add`.
 - If leaking the value would be a problem, use `fimo secrets add`.
-- If an agent needs a secret, first store it with `fimo secrets add`, then request it in that agent config with `fimo agents secrets add`.

package/assets/skills/fimo-cli/references/webhooks.md

@@ -26,7 +26,6 @@ Run this before writing a custom payload. The list shows supported event types,
 
 - Forms: `form.submitted`
 - Publish: `publish.started`, `publish.succeeded`, `publish.failed`, `publish.unpublished`
-- Agents: run started/completed/failed/cancelled and review requested/resolved
 - Analytics: `analytics.report_ready`
 - Media: uploaded/updated/deleted
 - Entries: `entry.changed`
@@ -108,7 +107,6 @@ Available filters are event-specific:
 
 - `--environments <selector>` for Main Branch (`main`), All Branches (`all`), Production (`production`), Automatic previews (`preview`), or one custom Environment ID; the default is `main`
 - `--form <id>` for `form.submitted`
-- `--agent <name>` for agent events
 - `--media-type <image|video|audio|document|other>` for media events
 - `--action <created|updated|deleted>`, `--content-type <name>`, and `--locale <locale>` for `entry.changed`
 

package/assets/skills/fimo-code/SKILL.md

@@ -90,6 +90,7 @@ For pageview installation or debugging, read [references/analytics.md](reference
 ## Non-negotiable boundaries
 
 - Do not hardcode editor-owned collections, page content, labels, or media in JSX.
+- Do not commit image or video files to the repository (`public/`, `static/`, `src/assets/`, or anywhere else). Upload every image or video you create, download, or receive as a local file with `fimo assets upload` (`fimo assets bulk-upload` for a batch) and reference the returned URL. Media from `fimo image …` and `fimo video …` tasks is already in the media library; use its URL instead of downloading it into the repository. A repository file has no asset ID, cannot be replaced in Studio, skips Fimo image optimization, and is invisible to asset usage checks. Only favicons and app icons (`favicon*`, `apple-touch-icon*`, `apple-icon*`, `android-chrome*`, `mstile*`, `icon*`), framework metadata images (`opengraph-image*`, `twitter-image*`), SVG icons and logos, and `robots.txt` stay in the repository.
 - Do not hand-roll content API fetches when a generated client covers the read.
 - Do not hand-construct `FimoString`, `FimoMedia`, or other tracked values.
 - Do not replace an application's router, locale library, URL policy, or SEO integration merely to add Fimo.

package/assets/skills/fimo-code/references/assets.md

@@ -2,7 +2,7 @@
 
 > For the CLI commands (`fimo assets upload`, `fimo image generate`, folder management) and the "when to generate AI images" workflow rules, see **`fimo-cli/references/assets.md`**.
 
-This file covers media fields and the Fimo image components.
+This file covers media fields and the Fimo image components. Image and video bytes live in the media library, never in the repository; see `SKILL.md` § Non-negotiable boundaries for the rule and its exceptions.
 
 ## Media field values
 
@@ -39,10 +39,10 @@ Generated reads wrap each media object in `FimoMedia`. Its `id`, `alt`, `name`,
 
 Import the primitives from the active framework adapter: `fimo-next` on the Next server, `fimo-next/client` in Next Client Components, `fimo-react` in React Router/Vite, or `fimo/astro/components` in Astro pages.
 
-| Asset source                                        | Component             | Pass via                  |
-| --------------------------------------------------- | --------------------- | ------------------------- |
-| Schema `media` field on an entry                    | `<Image>` / `<Video>` | `value={post.coverImage}` |
-| Hard-coded URL or generated asset referenced inline | `<StaticImage>`       | `src="https://..."`       |
+| Asset source                        | Component             | Pass via                  |
+| ----------------------------------- | --------------------- | ------------------------- |
+| Schema `media` field on an entry    | `<Image>` / `<Video>` | `value={post.coverImage}` |
+| Media-library URL referenced inline | `<StaticImage>`       | `src="https://..."`       |
 
 ```tsx
 import { Image, StaticImage, Video } from 'fimo-next';

package/assets/skills/fimo-code/references/design.md

@@ -124,7 +124,7 @@ Write these into the project's existing theme tokens and reference the tokens fr
 - **Treatment:** Full-bleed, contained, overlays, filters
 - **Hero:** Specific direction for hero imagery
 
-If the user hasn't supplied images and one is needed, run `fimo image generate --prompt "..."` and reuse the returned `url` or `id`. Run `fimo image generate --help` for current flags. See `references/assets.md`.
+If the user hasn't supplied images and one is needed, run `fimo image generate --prompt "..."` and reuse the returned `url` or `id`. Run `fimo image generate --help` for current flags. Upload any image that exists only as a local file before using it (`SKILL.md` § Non-negotiable boundaries). See `references/assets.md`.
 
 ### Iconography
 

package/assets/skills/fimo-code/references/frameworks/next.md

@@ -57,16 +57,7 @@ const nextConfig: NextConfig = {};
 export default withFimo(nextConfig);
 ```
 
-Preserve existing config fields and config-function logic. `withFimo` currently
-does not rewrite response headers or adapt application-owned CSP. A restrictive
-policy may need a manual Preview adaptation; inspect actual framing and blocked
-requests, preserve production protections, and verify the result in a browser.
-`frame-ancestors` permits the Studio parent, not the app's preview origin or a
-value derived from a preview-origin variable. `script-src`, `connect-src`,
-`frame-src`, and `form-action` concern resources/endpoints used by the iframe;
-use the resolved connection and observed requests. Never add a Studio-parent
-WebSocket to application CSP. Scope exceptions to Preview and keep unrelated
-security headers unchanged.
+Preserve existing config fields and config-function logic.
 
 ## Client dependency
 

package/assets/skills/fimo-code/references/ui.md

@@ -46,7 +46,7 @@ Blocks do not change this rule. Every visible nested scalar is source-tracked to
 
 Do not render those values as `{program.title}` or `{highlight.label}`. That displays text but bypasses the primitive that Studio uses to resolve the exact nested edit target.
 
-Use `<StaticImage>` only when the image is deliberately not editor-managed.
+Use `<StaticImage>` only when the image is deliberately not editor-managed. Its `src` is still a media-library URL; see `SKILL.md` § Non-negotiable boundaries.
 
 ## Wrapper values in JavaScript logic
 

package/assets/skills/fimo-migration/references/frameworks/nextjs.md

@@ -105,32 +105,11 @@ Do not create or edit `.env` / `.env.local` for a linked project's Fimo
 connection. Run the project's normal `next dev`, `next build`, and `next start`
 commands, then exercise at least one server read and one client-side data read.
 
-## Preview embedding and response headers
+## Preview integration
 
 Keep the generated `FimoProvider` and `withFimo` integration. It supports
 rendering Fimo Preview in Fimo Studio and enabling Edit Mode.
 
-The application owns response and security headers; `withFimo` currently does
-not rewrite them or adapt CSP automatically. A restrictive policy may still
-need a manual Preview adaptation. Inspect framing behavior and response headers
-first. Scope changes to Preview, preserve production protections and unrelated
-security headers, and record them in the runtime report's Hosting section.
-When the existing policy sends `X-Frame-Options` or an unconditional
-`frame-ancestors` block, condition or relax that framing control only for the
-verified Preview embedding context; retain it for non-Preview and production
-responses.
-
-- `frame-ancestors` controls which Fimo Studio parent may embed the app. The
-  incident's manual fix used the current Studio sources `https://fimo.ai` and
-  `https://*.fimo.ai`. Verify the Studio parent for the target environment;
-  these sources are not a universal resource allowlist. Never derive them from
-  a preview-origin variable. The sandbox or hosted preview origin identifies
-  the app being framed, not its ancestor.
-- `script-src` controls scripts, `connect-src` API and WebSocket connections,
-  `frame-src` frames embedded by the app, and `form-action` form submission
-  destinations. Base Fimo sources on the resolved connection and observed
-  requests made by the preview iframe, only for resources/endpoints it uses.
-
 ## Locales
 
 Keep these claims separate, and treat any one of them as unproven until its

package/assets/skills/fimo-migration/references/qa.md

@@ -112,17 +112,7 @@ and passes only the public connection to the browser. Run the normal `next dev`,
 Owned by the runtime lane; verified here read-only.
 
 - The target starts locally: the dev server responds without startup errors.
-- Fimo Preview renders the target in Fimo Studio and Edit Mode works. If either
-  is blocked, verify the actual framing behavior and response headers. The
-  application owns its security policy; any Preview exception must preserve
-  production protections and unrelated security headers.
-- Check CSP sources by purpose: `frame-ancestors` permits the Studio parent;
-  the app's preview origin is the framed site. `script-src`, `connect-src`,
-  `frame-src`, and `form-action` use resolved/observed Fimo resources and
-  endpoints actually used by the iframe. Do not copy ancestor sources into
-  resource directives or derive them from a preview-origin variable.
-- `withFimo` does not rewrite response headers. Verify any required manual
-  Preview adaptation of an application-owned restrictive policy.
+- Fimo Preview renders the target in Fimo Studio and Edit Mode works.
 - The runtime report covers local startup, preview embedding, build, the
   resolved Fimo connection, header translations, and integration env-key
   names, with every claim backed by evidence.

package/assets/skills/fimo-studio/SKILL.md

@@ -6,7 +6,7 @@ description: >-
   Triggers: "in Fimo Studio", "in the dashboard", "in the web app",
   "how do I X in the UI", or screenshots of the dashboard. Topics
   covered: dashboard content and CMS, publishing from the dashboard,
-  dashboard SEO/domain settings, site connections, agents, schedules and run history, outbound webhooks,
+  dashboard SEO/domain settings, site connections, schedules and run history, outbound webhooks,
   visual editing, version history UI, dashboard sharing/billing, dashboard chat,
   and the command palette. Never describe
   UI locations, buttons, or panels from memory — always read the relevant
@@ -34,8 +34,8 @@ Use plain, friendly language. Describe what users see, where they click, and wha
 
 ## Studio layout
 
-- **Header (desktop):** the site menu (site name; History is here) and the Branch switcher, then the workspaces: Chats, Getting started, Preview, Content, Assets, Agents, Analytics, Settings. Only workspaces the user can access appear. Workspaces that do not fit move into **More**. On the right: Earn free credits, Invite, Clone, Publish, and Merge on a Branch.
-- **Phone:** bottom tabs for Chat, Preview, Agents and Settings. Invite, Earn free credits and Clone ("Work on this site locally") move into the site menu.
+- **Header (desktop):** the site menu (site name; History is here) and the Branch switcher, then the workspaces: Chats, Getting started, Preview, Content, Assets, Analytics, Settings. Only workspaces the user can access appear. Workspaces that do not fit move into **More**. On the right: Earn free credits, Invite, Clone, Publish, and Merge on a Branch.
+- **Phone:** bottom tabs for Chat, Preview and Settings. Invite, Earn free credits and Clone ("Work on this site locally") move into the site menu.
 - **Settings:** General, Domains, Knowledge, SEO and Languages are listed directly. Models, Environments, Secrets, Schedules, Webhooks and Connections are under **Advanced settings**.
 - **Shortcuts:** Alt+1 Preview, Alt+2 Content, Alt+3 Assets, Alt+5 Settings, Alt+E edit mode, Cmd/Ctrl+K command palette.
 
@@ -56,7 +56,6 @@ Read the relevant reference file when the user's question matches a topic.
 | AI Chat                  | references/ai-chat.md                   | "What can the AI do?", "How do I give context?"                        |
 | Site Knowledge           | references/knowledge.md                 | "Set brand guidance", "Website goals", "Draft knowledge from the site" |
 | SEO Settings             | references/seo-settings.md              | "How do I set up SEO?", "Favicon, title, share image"                  |
-| Agents                   | references/agents.md                    | "Run an agent", "Pause an agent", "Next agent run"                     |
 | Schedules                | references/schedules.md                 | "Recurring commands", "Run history", "Run now"                         |
 | Webhooks                 | references/webhooks.md                  | "React to forms", "Send events to another service"                     |
 | Connections              | references/connections.md               | "Connect a service", "Add an MCP server"                               |
@@ -66,7 +65,6 @@ Read the relevant reference file when the user's question matches a topic.
 | Sharing & Collaboration  | references/sharing-and-collaboration.md | "How do I share?", "How do I invite someone?"                          |
 | Site Creation            | references/project-creation.md          | "How do I start a new site?"                                           |
 | Billing & Credits        | references/billing-and-credits.md       | "What are credits?", "How do I upgrade?", "How do referrals work?"     |
-| Drawing & Wireframing    | references/drawing-and-wireframing.md   | "How do I sketch my idea?"                                             |
 
 ## Cross-feature references
 
@@ -76,10 +74,9 @@ Read the relevant reference file when the user's question matches a topic.
 | Custom domains          | Publishing (must publish first), Billing (premium required)          |
 | Adding images           | Media Library, AI Chat, Edit Mode                                    |
 | Content/CMS             | AI Chat, Media Library                                               |
-| Webhooks                | Site secrets, Forms, Publishing, Agents                              |
-| Connections             | AI Chat, Agents, Site secrets                                        |
-| Agents                  | Connections, Site secrets, Branches                                  |
-| Schedules               | Site secrets, Environments, Agents                                   |
+| Webhooks                | Site secrets, Forms, Publishing                                      |
+| Connections             | AI Chat, Site secrets                                                |
+| Schedules               | Site secrets, Environments                                           |
 | Visual changes          | Edit Mode (CMS content), AI Chat (layout, styling, and code changes) |
 | Something went wrong    | Version History, AI Chat                                             |
 | Working with others     | Sharing, Collaboration                                               |