@noodleseed/agent-kit 0.23.1 → 0.24.0

package/manifest.json

@@ -1,9 +1,9 @@
 {
-  "packageVersion": "0.23.1",
+  "packageVersion": "0.24.0",
   "files": [
     {
       "path": "skills/codex/SKILL.md",
-      "sha256": "92202210906f0c056e4e34c169be95e4c52dd73c2c11f8074b60bacc4e24af28",
+      "sha256": "0554c0c35261c583a8024b6762a2540ad6e6627f73d6d22867eae497db7b88d2",
       "agentTarget": "codex"
     },
     {
@@ -33,7 +33,7 @@
     },
     {
       "path": "skills/codex/references/embedded-assistant.md",
-      "sha256": "3e96c4f322cadbd509957781005060a8526c8e60e610bcb7246edc1e86349bf9",
+      "sha256": "9eebab3471ae21b3b3ed5755f8151b297ed39e1bc08d6bcd7cdc1d75afce2f11",
       "agentTarget": "codex"
     },
     {
@@ -253,7 +253,7 @@
     },
     {
       "path": "skills/codex/examples/customer-auth/README.md",
-      "sha256": "ae55e8c5e88216a3a3b1f57084f16e7af0edbf1e5b35ade7be5d5394887347ae",
+      "sha256": "f0955609ac8a880d76e5f18fc4319d6de88e4e0d8623519a12afb111095fc057",
       "agentTarget": "codex"
     },
     {
@@ -268,12 +268,12 @@
     },
     {
       "path": "skills/codex/examples/customer-auth/src/server.ts",
-      "sha256": "549dd7d0ccfb2fff7b0f3ce23194145e7364f5fc337a27e2b6d50b3dd7fb264d",
+      "sha256": "cdd95b74a3e219db2eb9bad9b0c128720d8b8e030d5acd8163e46dd65e79bdf6",
       "agentTarget": "codex"
     },
     {
       "path": "skills/codex/examples/customer-auth/test/server.test.ts",
-      "sha256": "97e9f00f102ea65f74dd9bca93090eb961af431a8c1285c80028dfae191476d9",
+      "sha256": "bd46358f4abfd797903fc748797e0082faf0d2be906ede0ae5df0cb5f278a2db",
       "agentTarget": "codex"
     },
     {
@@ -378,7 +378,7 @@
     },
     {
       "path": "skills/claude-code/SKILL.md",
-      "sha256": "a2729d4dd959a01b7ff39f375855c4e0026f95adae8d1390748c9f7c8198ef38",
+      "sha256": "bc68fdca977ae01b9b0b02b075fbbe8fabf863d875fd539efd5f241390fc57d9",
       "agentTarget": "claude-code"
     },
     {
@@ -408,7 +408,7 @@
     },
     {
       "path": "skills/claude-code/references/embedded-assistant.md",
-      "sha256": "3e96c4f322cadbd509957781005060a8526c8e60e610bcb7246edc1e86349bf9",
+      "sha256": "9eebab3471ae21b3b3ed5755f8151b297ed39e1bc08d6bcd7cdc1d75afce2f11",
       "agentTarget": "claude-code"
     },
     {
@@ -628,7 +628,7 @@
     },
     {
       "path": "skills/claude-code/examples/customer-auth/README.md",
-      "sha256": "ae55e8c5e88216a3a3b1f57084f16e7af0edbf1e5b35ade7be5d5394887347ae",
+      "sha256": "f0955609ac8a880d76e5f18fc4319d6de88e4e0d8623519a12afb111095fc057",
       "agentTarget": "claude-code"
     },
     {
@@ -643,12 +643,12 @@
     },
     {
       "path": "skills/claude-code/examples/customer-auth/src/server.ts",
-      "sha256": "549dd7d0ccfb2fff7b0f3ce23194145e7364f5fc337a27e2b6d50b3dd7fb264d",
+      "sha256": "cdd95b74a3e219db2eb9bad9b0c128720d8b8e030d5acd8163e46dd65e79bdf6",
       "agentTarget": "claude-code"
     },
     {
       "path": "skills/claude-code/examples/customer-auth/test/server.test.ts",
-      "sha256": "97e9f00f102ea65f74dd9bca93090eb961af431a8c1285c80028dfae191476d9",
+      "sha256": "bd46358f4abfd797903fc748797e0082faf0d2be906ede0ae5df0cb5f278a2db",
       "agentTarget": "claude-code"
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/agent-kit",
-  "version": "0.23.1",
+  "version": "0.24.0",
   "private": false,
   "description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
   "license": "Apache-2.0",

package/skills/claude-code/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: noodle-seed
 description: Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI.
-version: 0.23.1
+version: 0.24.0
 hash: b4fc528d406e2149
 ---
 

package/skills/claude-code/examples/customer-auth/README.md

@@ -137,9 +137,15 @@ noodle variables set FIREBASE_AUTH_DOMAIN your-firebase-project.firebaseapp.com
 noodle check --target embedded-assistant src/server.ts
 ```
 
-Assistant origins are exact and HTTPS-only. A local embedding application must serve itself over HTTPS and
-declare an origin such as `https://localhost:3000`; `noodle dev` does not provide TLS for that separate web
-application.
+Assistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for
+loopback development origins such as `http://localhost:3000`, `http://127.0.0.1:3000`, or
+`http://[::1]:3000`. `noodle dev` serves the MCP project, not that separate embedding application.
+
+The assistant's panel, launcher, status header, composer, and message treatment are configured through the
+bounded `presentation` object in `src/server.ts`. The Atlas-style product treatment is the supported
+customization ceiling. These primitives derive their colors from the shared server `branding` block and
+require no edits to `@noodleseed/assistant`; raw HTML, CSS, inline SVG, renderer class names, and callbacks
+are intentionally not accepted in deployment configuration.
 
 Create the backend credential after deployment. The CLI writes it to a mode-0600 file and never prints the
 secret:

package/skills/claude-code/examples/customer-auth/src/server.ts

@@ -101,6 +101,15 @@ export default server(
         welcomeHeading: 'How can I help with Noodle Seed?',
         composerPlaceholder: 'Ask about your apps…',
       },
+      presentation: {
+        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },
+        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },
+        header: {
+          mark: 'status',
+          badge: { text: 'Workspace online', tone: 'success', indicator: true },
+        },
+        composer: { leadingIcon: 'brand-mark', shape: 'pill' },
+      },
       suggestedPrompts: ['Show my organizations', 'List the apps in my organization'],
     }),
   },

package/skills/claude-code/examples/customer-auth/test/server.test.ts

@@ -8,9 +8,16 @@ describe('customer-auth example', () => {
     expect(manifest.server.assistant).toMatchObject({
       model: { kind: 'openai-compatible', apiKey: 'ASSISTANT_MODEL_API_KEY' },
       layout: { mode: 'floating' },
+      presentation: {
+        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },
+        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },
+        header: { mark: 'status', badge: { text: 'Workspace online', tone: 'success' } },
+      },
     });
     expect(
-      manifest.server.assistant?.allowedOrigins.every((origin) => origin.startsWith('https://')),
+      manifest.server.assistant?.allowedOrigins.every(
+        (origin) => origin.startsWith('https://') || origin.startsWith('http://localhost:'),
+      ),
     ).toBe(true);
     expect(manifest.server.branding).toMatchObject({
       name: 'Noodle Seed Assistant',

package/skills/claude-code/references/embedded-assistant.md

@@ -4,6 +4,7 @@
 
 - Architecture
 - Author and validate
+- Customize the presentation
 - Configure and deploy
 - Access modes and customer auth
 - Create the backend client
@@ -56,6 +57,33 @@ noodle check --target embedded-assistant --json
 
 Use `noodle commands --json` before proposing command flags; do not invent flags from memory.
 
+## Customize the presentation
+
+Keep identity and semantic light/dark colors in the one server-level `branding` block. Put assistant-only structure in the bounded `presentation` object; it accepts curated primitives rather than raw HTML, CSS, SVG, class names, or callbacks:
+
+```ts
+assistant: embeddedAssistant({
+  model, allowedOrigins,
+  layout: { panelWidth: 520, panelMinHeight: 540, panelMaxHeight: 740, edgeOffset: 24 },
+  behavior: { showTimestamps: true },
+  labels: { composerPlaceholder: "Message Acme Support…", sessionReady: "Acme support is online" },
+  presentation: {
+    panel: { surface: "solid", elevation: "dramatic", border: "strong", radius: 20 },
+    launcher: { icon: "chat", size: "lg", status: "session", effect: "pulse" },
+    header: {
+      mark: "status",
+      badge: { text: "Online", tone: "success", indicator: true },
+    },
+    composer: { leadingIcon: "brand-mark", sendIcon: "paper-plane", shape: "rounded" },
+    messages: { userStyle: "accent", assistantStyle: "bubble" },
+  },
+}),
+```
+
+The Atlas-style product treatment above is the maximum deployment-configurable presentation. The bounded surface covers panel treatment, launcher icon/size/session pulse, header mark/status badge, composer controls, and message treatment; it does not accept custom header actions, structured empty-state layouts, footers, spectacle variants/effects, or tenant code.
+
+Omitted fields retain the polished Halo-derived baseline. Precedence is host slots/public `--ns-assistant-*` variables for application-specific integration, then the deployed semantic presentation, then the built-in defaults. Prefer `server.ts` configuration first so every embedding app receives the same assistant after redeploy; use slots only for behavior or content that is genuinely owned by that particular host page.
+
 ## Configure and deploy
 
 Local MCP authoring and tests need no account, but an external browser embed needs an active assistant-enabled deployment before a backend client can be created. Set the model values on the target org/app/env, then deploy:

package/skills/codex/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: noodle-seed
 description: Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI.
-version: 0.23.1
+version: 0.24.0
 hash: cd25535e1d6dbf4f
 ---
 

package/skills/codex/examples/customer-auth/README.md

@@ -137,9 +137,15 @@ noodle variables set FIREBASE_AUTH_DOMAIN your-firebase-project.firebaseapp.com
 noodle check --target embedded-assistant src/server.ts
 ```
 
-Assistant origins are exact and HTTPS-only. A local embedding application must serve itself over HTTPS and
-declare an origin such as `https://localhost:3000`; `noodle dev` does not provide TLS for that separate web
-application.
+Assistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for
+loopback development origins such as `http://localhost:3000`, `http://127.0.0.1:3000`, or
+`http://[::1]:3000`. `noodle dev` serves the MCP project, not that separate embedding application.
+
+The assistant's panel, launcher, status header, composer, and message treatment are configured through the
+bounded `presentation` object in `src/server.ts`. The Atlas-style product treatment is the supported
+customization ceiling. These primitives derive their colors from the shared server `branding` block and
+require no edits to `@noodleseed/assistant`; raw HTML, CSS, inline SVG, renderer class names, and callbacks
+are intentionally not accepted in deployment configuration.
 
 Create the backend credential after deployment. The CLI writes it to a mode-0600 file and never prints the
 secret:

package/skills/codex/examples/customer-auth/src/server.ts

@@ -101,6 +101,15 @@ export default server(
         welcomeHeading: 'How can I help with Noodle Seed?',
         composerPlaceholder: 'Ask about your apps…',
       },
+      presentation: {
+        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },
+        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },
+        header: {
+          mark: 'status',
+          badge: { text: 'Workspace online', tone: 'success', indicator: true },
+        },
+        composer: { leadingIcon: 'brand-mark', shape: 'pill' },
+      },
       suggestedPrompts: ['Show my organizations', 'List the apps in my organization'],
     }),
   },

package/skills/codex/examples/customer-auth/test/server.test.ts

@@ -8,9 +8,16 @@ describe('customer-auth example', () => {
     expect(manifest.server.assistant).toMatchObject({
       model: { kind: 'openai-compatible', apiKey: 'ASSISTANT_MODEL_API_KEY' },
       layout: { mode: 'floating' },
+      presentation: {
+        panel: { surface: 'glass', elevation: 'soft', border: 'subtle' },
+        launcher: { icon: 'brand-mark', status: 'session', effect: 'pulse' },
+        header: { mark: 'status', badge: { text: 'Workspace online', tone: 'success' } },
+      },
     });
     expect(
-      manifest.server.assistant?.allowedOrigins.every((origin) => origin.startsWith('https://')),
+      manifest.server.assistant?.allowedOrigins.every(
+        (origin) => origin.startsWith('https://') || origin.startsWith('http://localhost:'),
+      ),
     ).toBe(true);
     expect(manifest.server.branding).toMatchObject({
       name: 'Noodle Seed Assistant',

package/skills/codex/references/embedded-assistant.md

@@ -4,6 +4,7 @@
 
 - Architecture
 - Author and validate
+- Customize the presentation
 - Configure and deploy
 - Access modes and customer auth
 - Create the backend client
@@ -56,6 +57,33 @@ noodle check --target embedded-assistant --json
 
 Use `noodle commands --json` before proposing command flags; do not invent flags from memory.
 
+## Customize the presentation
+
+Keep identity and semantic light/dark colors in the one server-level `branding` block. Put assistant-only structure in the bounded `presentation` object; it accepts curated primitives rather than raw HTML, CSS, SVG, class names, or callbacks:
+
+```ts
+assistant: embeddedAssistant({
+  model, allowedOrigins,
+  layout: { panelWidth: 520, panelMinHeight: 540, panelMaxHeight: 740, edgeOffset: 24 },
+  behavior: { showTimestamps: true },
+  labels: { composerPlaceholder: "Message Acme Support…", sessionReady: "Acme support is online" },
+  presentation: {
+    panel: { surface: "solid", elevation: "dramatic", border: "strong", radius: 20 },
+    launcher: { icon: "chat", size: "lg", status: "session", effect: "pulse" },
+    header: {
+      mark: "status",
+      badge: { text: "Online", tone: "success", indicator: true },
+    },
+    composer: { leadingIcon: "brand-mark", sendIcon: "paper-plane", shape: "rounded" },
+    messages: { userStyle: "accent", assistantStyle: "bubble" },
+  },
+}),
+```
+
+The Atlas-style product treatment above is the maximum deployment-configurable presentation. The bounded surface covers panel treatment, launcher icon/size/session pulse, header mark/status badge, composer controls, and message treatment; it does not accept custom header actions, structured empty-state layouts, footers, spectacle variants/effects, or tenant code.
+
+Omitted fields retain the polished Halo-derived baseline. Precedence is host slots/public `--ns-assistant-*` variables for application-specific integration, then the deployed semantic presentation, then the built-in defaults. Prefer `server.ts` configuration first so every embedding app receives the same assistant after redeploy; use slots only for behavior or content that is genuinely owned by that particular host page.
+
 ## Configure and deploy
 
 Local MCP authoring and tests need no account, but an external browser embed needs an active assistant-enabled deployment before a backend client can be created. Set the model values on the target org/app/env, then deploy: