fimo 2.8.0 → 2.9.0-staging.1

package/assets/skills/fimo-cli/references/branches.md

@@ -83,12 +83,15 @@ fimo status --json           # machine-readable
 
 ```bash
 fimo merge feat/seo                   # merge feat/seo into the current Branch
-fimo merge feat/seo -y                # non-interactive: parent-wins on every conflict
+fimo merge feat/seo -y                # non-interactive: keep the target's value on every conflict
+fimo merge feat/seo --resume          # continue a stopped merge, or follow one still applying
 fimo merge feat/seo --allow-direct-merge   # override the "don't merge straight onto main" gate
 ```
 
 - Merging directly onto `main` is gated — the CLI refuses unless you pass `--allow-direct-merge`. Prefer merging on a branch and publishing.
-- On conflicts you get an interactive resolver per row: **parent** (keep the target's value), **child** (take the source's value), or **abort** (cancels the merge; the server runs compensating actions). `-y` accepts parent-wins for everything.
+- On conflicts nothing is applied. In a terminal you get a resolver per row: **parent** (keep the target's value), **child** (take the source's value), **pick** (edit in `$EDITOR`), or **abort**. `-y` keeps the target's value for everything.
+- `--json` never prompts. Unresolved conflicts exit non-zero with `MERGE_CONFLICTS`; `error.details` carries `merge_id`, `from`, `to`, and `conflicts`. Re-run with `--resume --yes` to keep the target's values, or resolve interactively.
+- After resolutions are accepted the CLI waits for the merge: success is `status: "ok"` with the completed merge's `mergeId` and `summary` but no `applied` list (per-surface counts are only reported when a merge applies cleanly without conflicts); `MERGE_FAILED` and `MERGE_CANCELLED` are terminal; `MERGE_IN_PROGRESS` means it is still applying — run `--resume` to keep following it. `--resume` never resubmits a merge that is already applying.
 
 ## `fimo pull`
 

package/assets/skills/fimo-cli/references/hosting.md

@@ -33,31 +33,25 @@ Declare redirects, headers, rewrites, and URL shape in
 
 Every field is optional. Only what you declare is emitted.
 
-## Preview and security headers
-
-A restrictive application-owned CSP or `X-Frame-Options` policy can block Studio
-Preview. Do not assume automatic header rewriting; Next.js `withFimo` does not
-provide it. Inspect the served policy and scope any manual adaptation to Preview,
-preserving production protections and unrelated headers. `frame-ancestors`
-permits the Studio parent, not the framed app's preview origin. Never derive
-ancestor sources from a preview-origin variable. For `script-src`, `connect-src`,
-`frame-src`, and `form-action`, use resolved/observed Fimo resources and endpoints
-actually used by the iframe. Studio-parent WebSockets do not belong in app CSP.
-
 ## Matching
 
 `source` matches the pathname only, never the query string.
 
-| Pattern         | Matches                                |
-| --------------- | -------------------------------------- |
-| `/about`        | exactly that path                      |
-| `/blog/:slug`   | one segment, captured as `slug`        |
-| `/proxy/:rest*` | any number of segments, including none |
-| `/(.*)`         | everything                             |
+| Pattern         | Matches                                       |
+| --------------- | --------------------------------------------- |
+| `/about`        | exactly that path                             |
+| `/blog/:slug`   | one segment, captured as `slug`               |
+| `/proxy/:rest*` | any number of segments, including none        |
+| `/(.*)`         | everything                                    |
+| `/:path(.*)`    | everything, including `/`, captured as `path` |
 
 Captured names are reusable in `destination`: `/blog/:slug` →
 `/posts/:slug`. `destination` may be an absolute path or an external URL.
 
+Fimo preserves `source` as written. Use `/:path(.*)` when a redirect, rewrite,
+or header rule must include the homepage `/`; do not assume `/:path*` includes
+it. Keep `:path*` in the destination to reuse the captured path.
+
 ## Conditions
 
 Any redirect, rewrite, or header rule can require more than a path match. `has`
@@ -93,9 +87,15 @@ them are present.
 Omit `value` to match on presence alone, as the `consent` cookie above does.
 The redirect example requires the request to include `x-promo: summer`.
 
+For a www-to-apex redirect, connect both hostnames and use
+`{"source":"/:path(.*)","has":[{"type":"host","value":"www.example.com"}],"destination":"https://example.com/:path*","statusCode":301}`.
+The host condition matches the visitor's requested hostname. Verify `/`, a
+nested path, and a query string, and check that the destination host does not
+redirect back.
+
 **Prefer doing this in the application when it can.** Middleware, a loader, or a
-server component can be run and tested locally; a condition here only takes
-effect once published, so a mistake is found in production. Reach for `has` when
+server component can be run and tested locally; a condition here takes effect
+on hosted deployments and needs verification there. Reach for `has` when
 the app cannot act — a redirect that must happen before any code runs, or a
 header on a static asset.
 
@@ -121,6 +121,6 @@ header on a static asset.
 ## Verify
 
 `fimo validate` rejects an unknown `hosting` key, so a typo fails locally
-rather than silently doing nothing in production. Behaviour itself only takes
-effect once published — check the live URL after `fimo deploy --publish`, not
-the preview.
+rather than silently doing nothing in production. Hosting rules apply to
+hosted deployments; the sandbox dev server does not exercise them. Verify
+affected routes on the hosted preview and after an authorized publish.

package/assets/skills/fimo-code/references/frameworks/next.md

@@ -57,16 +57,7 @@ const nextConfig: NextConfig = {};
 export default withFimo(nextConfig);
 ```
 
-Preserve existing config fields and config-function logic. `withFimo` currently
-does not rewrite response headers or adapt application-owned CSP. A restrictive
-policy may need a manual Preview adaptation; inspect actual framing and blocked
-requests, preserve production protections, and verify the result in a browser.
-`frame-ancestors` permits the Studio parent, not the app's preview origin or a
-value derived from a preview-origin variable. `script-src`, `connect-src`,
-`frame-src`, and `form-action` concern resources/endpoints used by the iframe;
-use the resolved connection and observed requests. Never add a Studio-parent
-WebSocket to application CSP. Scope exceptions to Preview and keep unrelated
-security headers unchanged.
+Preserve existing config fields and config-function logic.
 
 ## Client dependency
 

package/assets/skills/fimo-migration/references/frameworks/nextjs.md

@@ -105,32 +105,11 @@ Do not create or edit `.env` / `.env.local` for a linked project's Fimo
 connection. Run the project's normal `next dev`, `next build`, and `next start`
 commands, then exercise at least one server read and one client-side data read.
 
-## Preview embedding and response headers
+## Preview integration
 
 Keep the generated `FimoProvider` and `withFimo` integration. It supports
 rendering Fimo Preview in Fimo Studio and enabling Edit Mode.
 
-The application owns response and security headers; `withFimo` currently does
-not rewrite them or adapt CSP automatically. A restrictive policy may still
-need a manual Preview adaptation. Inspect framing behavior and response headers
-first. Scope changes to Preview, preserve production protections and unrelated
-security headers, and record them in the runtime report's Hosting section.
-When the existing policy sends `X-Frame-Options` or an unconditional
-`frame-ancestors` block, condition or relax that framing control only for the
-verified Preview embedding context; retain it for non-Preview and production
-responses.
-
-- `frame-ancestors` controls which Fimo Studio parent may embed the app. The
-  incident's manual fix used the current Studio sources `https://fimo.ai` and
-  `https://*.fimo.ai`. Verify the Studio parent for the target environment;
-  these sources are not a universal resource allowlist. Never derive them from
-  a preview-origin variable. The sandbox or hosted preview origin identifies
-  the app being framed, not its ancestor.
-- `script-src` controls scripts, `connect-src` API and WebSocket connections,
-  `frame-src` frames embedded by the app, and `form-action` form submission
-  destinations. Base Fimo sources on the resolved connection and observed
-  requests made by the preview iframe, only for resources/endpoints it uses.
-
 ## Locales
 
 Keep these claims separate, and treat any one of them as unproven until its

package/assets/skills/fimo-migration/references/qa.md

@@ -112,17 +112,7 @@ and passes only the public connection to the browser. Run the normal `next dev`,
 Owned by the runtime lane; verified here read-only.
 
 - The target starts locally: the dev server responds without startup errors.
-- Fimo Preview renders the target in Fimo Studio and Edit Mode works. If either
-  is blocked, verify the actual framing behavior and response headers. The
-  application owns its security policy; any Preview exception must preserve
-  production protections and unrelated security headers.
-- Check CSP sources by purpose: `frame-ancestors` permits the Studio parent;
-  the app's preview origin is the framed site. `script-src`, `connect-src`,
-  `frame-src`, and `form-action` use resolved/observed Fimo resources and
-  endpoints actually used by the iframe. Do not copy ancestor sources into
-  resource directives or derive them from a preview-origin variable.
-- `withFimo` does not rewrite response headers. Verify any required manual
-  Preview adaptation of an application-owned restrictive policy.
+- Fimo Preview renders the target in Fimo Studio and Edit Mode works.
 - The runtime report covers local startup, preview embedding, build, the
   resolved Fimo connection, header translations, and integration env-key
   names, with every claim backed by evidence.

package/assets/skills/fimo-studio/references/ai-chat.md

@@ -10,15 +10,21 @@ Chat has its own **Chats** tab in the site header; the tab shows how many chats
 
 Agents and routines appear only when the organization has the agents feature, which is off by default in production. Without it, the **+** above the chat list opens a new chat directly, agent settings have no **Routines**, and existing routines do not run; ask Fimo support to enable it.
 
-An agent is a chat with a job: a name and a description that Fimo reads at the start of every reply in that chat. Agents are shared like any chat and are listed as soon as they are created, with an **Agent** tag after the name. The **+** above the chat list is a menu: **New chat** (blank), **New agent** (a name and a description, then the empty agent opens), and under **Agents** Fimo's default agents (**SEO**, **GEO**); a new site starts with both listed, their routines active from the start, and on an older site selecting a default creates the site's chat for it the first time, the same chat every time after. In an agent, the description shows next to its name in the header (one line) and the empty state introduces the agent by name and job (the description's first three lines); a cut description shows whole on hover, or on tap on a phone, and the message box reads **Message <name>**. The agent's settings page has a **Description** field, shared with everyone; empty means none. The filter icon's **Kind** option shows only chats or only agents; search finds an agent by its name.
+An agent is a chat with a job: a name and a description that Fimo reads at the start of every reply in that chat. Agents are shared like any chat and are listed as soon as they are created, with an **Agent** tag after the name. The **+** above the chat list is a menu: **New chat** (blank), **New agent** (a name and a description, then the empty agent opens), and under **Agents** Fimo's default agents (**SEO**, **GEO**, **Content**, **Quality**, **Compliance**); a new site starts with SEO and GEO listed, their routines active from the start; Content, Quality and Compliance, and every default on an older site, are created the first time someone selects them, routines active, the same chat every time after. In an agent, the description shows next to its name in the header (one line) and the empty state introduces the agent by name and job (the description's first three lines); a cut description shows whole on hover, or on tap on a phone, and the message box reads **Message <name>**. The agent's settings page has a **Description** field, shared with everyone; empty means none. The filter icon's **Kind** option shows only chats or only agents; search finds an agent by its name.
 
-The **SEO** default runs seven routines backed by Studio's built-in `fimo-seo` skill, which checks the site as a browser renders it and fixes at the source: **Technical SEO** (status, redirects, canonicals, sitemap, robots.txt, language, main heading), **Broken links**, **Meta tags** (titles, descriptions, Open Graph, the site's title ending, length in characters and pixels), **Image SEO** (alt text, file names, images over 200 KB), **Hreflang** (only on a site in more than one language) and **SEO monitoring** (changes since its last run, pages moved without a redirect) every day, and **Internal linking** (orphan and deep pages, articles with no link up to a hub or product page or more than eight links) every Monday. A page it changed is left alone for 8 weeks, the time Google takes to show the effect. A fix with one right answer from the page's own words is made without a message (a link only once the new target is checked to be the same content in the same language); a change to what visitors read, which page wins a search, whether a page exists, or a redirect is asked as a decision; prices, legal pages, the robots policy, redirects that carry traffic and page removals are never changed on its own. What a check could not tell (a timeout, a 5xx, a page past the crawl limit) is never acted on: the run retries once, then says the check was incomplete.
+The **SEO** default runs seven routines backed by Studio's built-in `fimo-seo` skill, which checks the site as a browser renders it and fixes at the source: **Technical SEO** (status, redirects, canonicals, sitemap, robots.txt, language, main heading), **Broken links**, **Meta tags** (titles, descriptions, Open Graph, the site's title ending, length in characters and pixels), **Image SEO** (alt text, file names, images over 200 KB: one in the media library or the site's own files is rendered through Fimo's resizing on its own, a file of the site uploaded first), **Hreflang** (only on a site in more than one language) and **SEO monitoring** (changes since its last run, pages moved without a redirect) every day, and **Internal linking** (orphan and deep pages, articles with no link up to a hub or product page or more than eight links) every Monday. A page it changed is left alone for 8 weeks, the time Google takes to show the effect. A fix with one right answer from the page's own words is made without a message (a link only once the new target is checked to be the same content in the same language; a link on words the text already uses to name another page; a 301 from a page's old address once the same page is live at a new one); a change to what visitors read, which page wins a search, whether a page exists, a redirect with more than one possible target, a price or a legal page is asked as a decision; page removals and the robots policy are never changed on its own. A change a person asks for in a chat is made. What a check could not tell (a timeout, a 5xx, a page past the crawl limit) is never acted on: the run retries once, then says the check was incomplete.
 
 The **GEO** default runs three routines backed by Studio's built-in `fimo-geo` skill, which shares `fimo-seo`'s crawl and its rule for what a run may change alone: **AI readiness** (llms.txt, the text each page serves before JavaScript, landmarks and heading levels) and **Structured data** (valid JSON-LD; Organization and WebSite, Article, BreadcrumbList; Product and FAQ where they fit) every day, and **AI citation optimization** (a direct answer under each content page's H1, question headings on long pages) every Wednesday. On its own it writes a missing llms.txt and keeps its links in step, adds Organization, WebSite, Article and BreadcrumbList from fields the site already has (never an invented logo, address, author or rating), and fixes landmarks and heading levels without changing words; an opening answer, new headings, FAQ or Product data, and how pages are rendered are asked as decisions; who robots.txt lets crawl, AI crawlers included, prices and claims are never changed, nor reported: asked whether an assistant can read the site, it checks and names the crawlers robots.txt keeps out. Where AI assistants cite the site needs a visibility source; until one is connected there is no routine for it.
 
+The **Content** default runs three routines backed by Studio's built-in `fimo-content` skill, on the same crawl and rule: **Content refresh** every Tuesday (past years written as the present, events and offers whose date passed, "coming soon" text, product names the team retired, pages losing visitors in Fimo analytics), **Content lifecycle** on the 1st of every month (thin pages, pages that repeat another, pages nothing links to that are also thin or out of date) and **Translation** every Wednesday (CMS entries missing in a locale, or whose source changed after the translation; on a site with one locale it stops at once). On its own it translates missing and outdated entries in the site's tone, keeping slugs, dates, media and names, and renders a copyright year typed in the code from the date; any other sentence a visitor reads is asked as a decision quoting the exact words; merging, redirecting or retiring a page is only proposed; a price or a legal page is changed or translated only once a person agreed. Writing from briefs and watching competitors need data sources; until they are connected there is no routine for them.
+
+The **Quality** default runs two routines every Thursday backed by Studio's built-in `fimo-quality` skill, whose crawl also measures accessibility in each page and opens one or two pages of each template again 390 px wide: **Accessibility** (WCAG AA contrast, heading levels, links, buttons and fields without a name, images used as links with no name, positive tabindex, invisible focus, the page language) and **Mobile optimization** (a missing viewport or one that blocks zoom, sideways scrolling, images, tables and forms wider than the screen, tap targets under 24 × 24 px, text mostly under 12 px). On its own it names a control or labels a field from words the page shows, fixes heading levels, tabindex and a removed focus outline, lets visitors zoom again and keeps media inside the screen; a colour, a size or a layout change is asked as a decision. Image alt text stays with the SEO agent; brand compliance needs brand guidelines, so there is no routine for it yet.
+
+The **Compliance** default runs three routines backed by Studio's built-in `fimo-compliance` skill, on the same crawl, which can also open a sample of pages with no consent given and record the cookies, third-party requests, consent banner and form fields a first visit gets: **Brand compliance** every Thursday (words, terms, claims and voice of what changed, against the brand rules in the site knowledge, `AGENTS.md` and the agent's memory; it runs on Claude Haiku 5.5), **Cookie consent** every Thursday (trackers and third-party cookies before a choice, a missing banner, a banner with no way to refuse) and **Privacy and legal pages** on the 1st of every month (a privacy page that exists, names the services loaded and the kinds of field the forms collect, and was updated in the last two years). On its own it changes only a term the brand rules replace; every other sentence, the consent setup and every legal page are proposed as decisions, with placeholders for legal details, and it never states that a site is compliant.
+
 ### Routines
 
-A routine is saved instructions an agent runs in a thread of its own, by hand, on a schedule, or when something happens in the project, so each run sees its earlier runs and the agent's chat never fills with its work. The agent creates, changes, runs and deletes its routines from its chat with its `routines` tool: a person asks in the chat ("check the prices every Monday", "run after each publish"), and Studio only shows routines. A trigger is set in words; Fimo checks them and either says when the routine runs or why it cannot follow them and what it can do instead; for what Fimo cannot see as an event (traffic, rankings, errors, other web sites) the agent offers a schedule whose run checks it and stops when there is nothing to do. Fimo follows publishes of the site and content changes on the main branch by content type, action, locale, changed fields, the entry's current values ("price over 100", "status changes to archived") or a yes/no question about what the content says ("mentions Contentful or Sanity"; for "a competitor" it uses the names given or those in the site knowledge, and asks for them otherwise; a run started on an uncertain answer says so), media files uploaded or changed (by name or file type), the site's code changing through a deploy or a merge (by file path glob), another routine of the same agent finishing (optionally with a yes/no question about its report; never its own end), a visitor submitting a form (optionally with a yes/no question about the answers), a form or content type changing, a branch merged into main, a locale added, removed or made the default, a publish of the site failing, and a domain added or removed; comparing a field's old and new values is not supported; what a routine changes, publishes or reports can start the agent's other routines, in chains of any length, each routine at most once per change that started the chain (across every routine that change leads to, so routines never loop or multiply; a person's new change, a run by hand or on a schedule starts a new chain); events that come in while a run is busy wait, then run together in one next run (up to 10), which the Runs list shows as one run with its event count. The agent's settings list its **Routines** as cards (name, cadence such as **Every Monday at 08:00** or **By hand**, next run, an **Active** switch); the default agents come with theirs. A routine's page is read-only: **Instructions** (the task, run on every trigger), **Model** (the model its runs use: Opus 5.5 by default; the agent sets another when asked), **Triggers** (**By hand** with **Run now**, which starts a run right away; **Schedule** and the event trigger, given a short title by Fimo from the words it was set with, each a sentence, shown when set), the **Runs** list (newest first, two lines each: how it ended (**Quiet**, **Sent to agent**, **Asked for a decision**, or **Failed** and **Stopped** in red), when and what started it (**On schedule**, **On event**, or **By hand** with the person's name or **agent** when their message started it), then the first sentence of what it told the agent; select one to open the routine's thread, read-only, at that run), and the **Active** switch in the header (pauses the schedule and the trigger, not **Run now**). Routines report to the agent, never to a person: a run that has something the agent should know writes it to the agent's chat as a message only the agent reads, and the agent takes a turn on it (reports waiting together are read in one turn); a run with nothing to say reports nothing. The agent decides what the team sees: nothing (the chat stays as it was, the row stays read), one short message (several reports folded into one), or a form when a person must decide, and the chat's row reads **Needs you** while that form is open. A person answers the form in the chat; the agent sends the decision to the routine with its `routines` tool and the routine runs again with it. Only the agent answers a routine: its page has no answer box. Quiet runs leave no message: they fold into one line placed where the last run happened among the messages (**N runs since <date>**), counted from the last report the agent answered visibly, and the chat's row reads **Ran <date>** with that count while the newest thing in the chat is a run, the ordinary status and the last words when a message is newer, and **First check <day> <time>** or **No checks scheduled** before the first run. A routine whose runs keep failing or are refused for credits is reported to the agent once per streak, as a message from Fimo. Routine runs use the plan's agent-hours, from each run's start to its end (Studio chats do not); Billing shows the hours used this period, and each run shows its duration and credits. Once the included hours are used, nothing runs (no schedule, event or Run now, which the routines tool reports to the agent); Studio shows **Routines paused** under the chat list and in the agent's settings with the reset date and the button that resumes them sooner (**Upgrade**), and the routine's page says until when. No run lasts longer than 2 hours.
+A routine is saved instructions an agent runs in a thread of its own, by hand, on a schedule, or when something happens in the project, so each run sees its earlier runs and the agent's chat never fills with its work. The agent creates, changes, runs and deletes its routines from its chat with its `routines` tool: a person asks in the chat ("check the prices every Monday", "run after each publish"), and Studio only shows routines. A trigger is set in words; Fimo checks them and either says when the routine runs or why it cannot follow them and what it can do instead; for what Fimo cannot see as an event (traffic, rankings, errors) the agent offers a schedule whose run checks it and stops when there is nothing to do. Fimo follows publishes of the site and content changes on the main branch by content type, action, locale, changed fields, the entry's current values ("price over 100", "status changes to archived") or a yes/no question about what the content says ("mentions Contentful or Sanity"; for "a competitor" it uses the names given or those in the site knowledge, and asks for them otherwise; a run started on an uncertain answer says so), media files uploaded or changed (by name or file type), the site's code changing through a deploy or a merge (by file path glob), another routine of the same agent finishing (optionally with a yes/no question about its report; never its own end), a visitor submitting a form (optionally with a yes/no question about the answers), a form or content type changing, a branch merged into main, a locale added, removed or made the default, a publish of the site failing, a domain added or removed, and the prices on a page of another web site changing ("tell me when https://example.com/pricing changes its prices": checked daily, a change must hold on three reads before the routine runs, the run lists each plan with its old and new price, the routine page shows the watch as **OK**, **Needs repair**, **Blocked** or **Unstable** with its last check, at most 10 watched pages a project); comparing a field's old and new values is not supported; what a routine changes, publishes or reports can start the agent's other routines, in chains of any length, each routine at most once per change that started the chain (across every routine that change leads to, so routines never loop or multiply; a person's new change, a run by hand or on a schedule starts a new chain); events that come in while a run is busy wait, then run together in one next run (up to 10), which the Runs list shows as one run with its event count. The agent's settings list its **Routines** as cards (name, cadence such as **Every Monday at 08:00** or **By hand**, next run, an **Active** switch); the default agents come with theirs. A routine's page is read-only: **Instructions** (the task, run on every trigger), **Model** (the model its runs use: Opus 5.5 by default; the agent sets another when asked), **Triggers** (**By hand** with **Run now**, which starts a run right away; **Schedule** and the event trigger, given a short title by Fimo from the words it was set with, each a sentence, shown when set), the **Runs** list (newest first, two lines each: how it ended (**Quiet**, **Sent to agent**, **Asked for a decision**, or **Failed** and **Stopped** in red), when and what started it (**On schedule**, **On event**, or **By hand** with the person's name or **agent** when their message started it), then the first sentence of what it told the agent; select one to open the routine's thread, read-only, at that run), and the **Active** switch in the header (pauses the schedule and the trigger, not **Run now**). Routines report to the agent, never to a person: a run that has something the agent should know writes it to the agent's chat as a message only the agent reads, and the agent takes a turn on it (reports waiting together are read in one turn); a run with nothing to say reports nothing. The agent decides what the team sees: nothing (the chat stays as it was, the row stays read), one short message (several reports folded into one), or a form when a person must decide, and the chat's row reads **Needs you** while that form is open. A person answers the form in the chat; the agent sends the decision to the routine with its `routines` tool and the routine runs again with it. Only the agent answers a routine: its page has no answer box. Quiet runs leave no message: they fold into one line placed where the last run happened among the messages (**N runs since <date>**), counted from the last report the agent answered visibly, and the chat's row reads **Ran <date>** with that count while the newest thing in the chat is a run, the ordinary status and the last words when a message is newer, and **First check <day> <time>** or **No checks scheduled** before the first run. A routine whose runs keep failing or are refused for credits is reported to the agent once per streak, as a message from Fimo. Routine runs use the plan's agent-hours, from each run's start to its end (Studio chats do not); Billing shows the hours used this period, and each run shows its duration and credits. Once the included hours are used, nothing runs (no schedule, event or Run now, which the routines tool reports to the agent); Studio shows **Routines paused** under the chat list and in the agent's settings with the reset date and the button that resumes them sooner (**Upgrade**), and the routine's page says until when. No run lasts longer than 2 hours.
 
 ## Sending a Message
 

package/assets/skills/fimo-studio/references/preview-and-responsive.md

@@ -39,6 +39,7 @@ You may see different overlays depending on what is happening:
 - **"Editing unavailable"** -- The site remains visible, but its Fimo integration did not connect in time. Visual editing and the route selector stay unavailable; preview and refresh still work.
 - **Error overlay** -- Something went wrong. The overlay shows details about the issue, and the AI can often auto-fix it for you.
 - **"Some installed packages need approval"** -- Choose **Fix with Fimo** to send the complete repair context to the coding agent, or **Copy details** to handle it elsewhere. Review every named package, commit only trusted package-specific approvals, and retry Preview. Never replace the site policy with a blanket allow-all setting.
+- **"Your app could not start"** -- The site's own dev command exited while starting; the output is available through **Copy details**. Choose **Fix with Fimo** to send that output to the coding agent, **Retry preview** to start it once more, or **Copy details** to handle it elsewhere. Fix the cause in the project, such as declaring the package that provides a missing command, rather than working around it. Preview also retries after the fix lands.
 - **First generation progress** -- When your site is being built for the first time, a progress overlay shows the current status.
 
 ## Switching Workspaces

package/dist/build/astro/config.js

@@ -17,7 +17,38 @@ export function fimo(options = {}) {
     return {
         name: 'fimo:astro',
         hooks: {
-            'astro:config:setup': ({ config, injectScript, updateConfig }) => {
+            'astro:config:setup': async ({ config, command, injectScript, updateConfig, addMiddleware }) => {
+                // Hosted builds supply deployment-scoped values through .env. An explicit
+                // empty process value still disables adaptation for published builds.
+                const { loadEnv } = await import('vite');
+                const studioOrigin = process.env.FIMO_PREVIEW_PARENT_ORIGIN ??
+                    loadEnv(config.vite?.mode ?? (command === 'dev' ? 'development' : 'production'), config.vite?.envDir ?? fileURLToPath(config.root), 'FIMO_PREVIEW_PARENT_ORIGIN').FIMO_PREVIEW_PARENT_ORIGIN;
+                if (studioOrigin) {
+                    // FIMO-2910: run outside application middleware so its final response
+                    // is adapted too. Capture the preview build's origin, never request input.
+                    const id = 'virtual:fimo-preview-frame-headers';
+                    addMiddleware({ entrypoint: id, order: 'pre' });
+                    updateConfig({
+                        vite: {
+                            plugins: [
+                                {
+                                    name: 'fimo:astro-preview-frame-headers',
+                                    resolveId(source) {
+                                        if (source === id)
+                                            return `\0${id}`;
+                                    },
+                                    load(source) {
+                                        if (source !== `\0${id}`)
+                                            return;
+                                        return `import { adaptPreviewFrameResponse } from 'fimo/preview';
+export const onRequest = async (_context, next) =>
+  adaptPreviewFrameResponse(await next(), ${serializeForModule(studioOrigin)});`;
+                                    },
+                                },
+                            ],
+                        },
+                    });
+                }
                 const hasVercelAdapter = config.integrations?.some((integration) => integration.name === '@astrojs/vercel' || integration.name.startsWith('@astrojs/vercel/'));
                 if (config.output === 'server' && !config.adapter && !hasVercelAdapter) {
                     if (!options.hostingAdapter) {

package/dist/cli/bundle.json

@@ -1,7 +1,7 @@
 {
   "bundled": true,
   "bundler": "esbuild",
-  "bundledAt": "2026-10-16T13:06:20.413Z",
+  "bundledAt": "2026-10-20T13:17:16.750Z",
   "cliVersion": "2.8.0",
   "external": [
     "oxc-parser",