@noodleseed/agent-kit 0.28.0 → 0.30.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/manifest.json +15 -15
- package/package.json +1 -1
- package/skills/claude-code/SKILL.md +1 -1
- package/skills/claude-code/examples/acme-tasks/README.md +4 -0
- package/skills/claude-code/examples/acme-tasks/src/server.ts +3 -0
- package/skills/claude-code/examples/food-ordering/README.md +3 -2
- package/skills/claude-code/references/authoring-workflow.md +1 -1
- package/skills/claude-code/references/embedded-assistant.md +10 -2
- package/skills/claude-code/references/sdk-surface.md +1 -1
- package/skills/codex/SKILL.md +1 -1
- package/skills/codex/examples/acme-tasks/README.md +4 -0
- package/skills/codex/examples/acme-tasks/src/server.ts +3 -0
- package/skills/codex/examples/food-ordering/README.md +3 -2
- package/skills/codex/references/authoring-workflow.md +1 -1
- package/skills/codex/references/embedded-assistant.md +10 -2
- package/skills/codex/references/sdk-surface.md +1 -1
package/manifest.json
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
{
|
|
2
|
-
"packageVersion": "0.
|
|
2
|
+
"packageVersion": "0.30.0",
|
|
3
3
|
"files": [
|
|
4
4
|
{
|
|
5
5
|
"path": "skills/codex/SKILL.md",
|
|
6
|
-
"sha256": "
|
|
6
|
+
"sha256": "1c4dd7e2af79db3ca212106bf8764db5471ba828861cc1b438be777665d02b41",
|
|
7
7
|
"agentTarget": "codex"
|
|
8
8
|
},
|
|
9
9
|
{
|
|
10
10
|
"path": "skills/codex/references/sdk-surface.md",
|
|
11
|
-
"sha256": "
|
|
11
|
+
"sha256": "769ac9217397298ec8b25236a008d11a84406a7fab6584ae929e5eacc2054cdc",
|
|
12
12
|
"agentTarget": "codex"
|
|
13
13
|
},
|
|
14
14
|
{
|
|
@@ -28,12 +28,12 @@
|
|
|
28
28
|
},
|
|
29
29
|
{
|
|
30
30
|
"path": "skills/codex/references/authoring-workflow.md",
|
|
31
|
-
"sha256": "
|
|
31
|
+
"sha256": "719b5ba7b04ce8c96129ac00809683889552b1bb56cba3a2ce11b9f9466ae672",
|
|
32
32
|
"agentTarget": "codex"
|
|
33
33
|
},
|
|
34
34
|
{
|
|
35
35
|
"path": "skills/codex/references/embedded-assistant.md",
|
|
36
|
-
"sha256": "
|
|
36
|
+
"sha256": "ae70a4fdac98b74c59897f16691d3655c94bdd0b06510329b84b651b2333d33a",
|
|
37
37
|
"agentTarget": "codex"
|
|
38
38
|
},
|
|
39
39
|
{
|
|
@@ -198,7 +198,7 @@
|
|
|
198
198
|
},
|
|
199
199
|
{
|
|
200
200
|
"path": "skills/codex/examples/acme-tasks/README.md",
|
|
201
|
-
"sha256": "
|
|
201
|
+
"sha256": "3fbc0821badfea43af4aab131d09f7c953095e0d241de7ea5cfcc3491b70fce5",
|
|
202
202
|
"agentTarget": "codex"
|
|
203
203
|
},
|
|
204
204
|
{
|
|
@@ -228,7 +228,7 @@
|
|
|
228
228
|
},
|
|
229
229
|
{
|
|
230
230
|
"path": "skills/codex/examples/acme-tasks/src/server.ts",
|
|
231
|
-
"sha256": "
|
|
231
|
+
"sha256": "0abd695218d0fd73abde31b2ea16742a028721044ef3c565bdc88cdbb10f19aa",
|
|
232
232
|
"agentTarget": "codex"
|
|
233
233
|
},
|
|
234
234
|
{
|
|
@@ -278,7 +278,7 @@
|
|
|
278
278
|
},
|
|
279
279
|
{
|
|
280
280
|
"path": "skills/codex/examples/food-ordering/README.md",
|
|
281
|
-
"sha256": "
|
|
281
|
+
"sha256": "013e0734831996d692c3ec314c7457156818089ace8e39ab79a5bf6d74262631",
|
|
282
282
|
"agentTarget": "codex"
|
|
283
283
|
},
|
|
284
284
|
{
|
|
@@ -378,12 +378,12 @@
|
|
|
378
378
|
},
|
|
379
379
|
{
|
|
380
380
|
"path": "skills/claude-code/SKILL.md",
|
|
381
|
-
"sha256": "
|
|
381
|
+
"sha256": "e4a9d32883a8d9b2d0dbb8f758977beb8a8334e93321d4eb50bad5db94e478ae",
|
|
382
382
|
"agentTarget": "claude-code"
|
|
383
383
|
},
|
|
384
384
|
{
|
|
385
385
|
"path": "skills/claude-code/references/sdk-surface.md",
|
|
386
|
-
"sha256": "
|
|
386
|
+
"sha256": "769ac9217397298ec8b25236a008d11a84406a7fab6584ae929e5eacc2054cdc",
|
|
387
387
|
"agentTarget": "claude-code"
|
|
388
388
|
},
|
|
389
389
|
{
|
|
@@ -403,12 +403,12 @@
|
|
|
403
403
|
},
|
|
404
404
|
{
|
|
405
405
|
"path": "skills/claude-code/references/authoring-workflow.md",
|
|
406
|
-
"sha256": "
|
|
406
|
+
"sha256": "719b5ba7b04ce8c96129ac00809683889552b1bb56cba3a2ce11b9f9466ae672",
|
|
407
407
|
"agentTarget": "claude-code"
|
|
408
408
|
},
|
|
409
409
|
{
|
|
410
410
|
"path": "skills/claude-code/references/embedded-assistant.md",
|
|
411
|
-
"sha256": "
|
|
411
|
+
"sha256": "ae70a4fdac98b74c59897f16691d3655c94bdd0b06510329b84b651b2333d33a",
|
|
412
412
|
"agentTarget": "claude-code"
|
|
413
413
|
},
|
|
414
414
|
{
|
|
@@ -573,7 +573,7 @@
|
|
|
573
573
|
},
|
|
574
574
|
{
|
|
575
575
|
"path": "skills/claude-code/examples/acme-tasks/README.md",
|
|
576
|
-
"sha256": "
|
|
576
|
+
"sha256": "3fbc0821badfea43af4aab131d09f7c953095e0d241de7ea5cfcc3491b70fce5",
|
|
577
577
|
"agentTarget": "claude-code"
|
|
578
578
|
},
|
|
579
579
|
{
|
|
@@ -603,7 +603,7 @@
|
|
|
603
603
|
},
|
|
604
604
|
{
|
|
605
605
|
"path": "skills/claude-code/examples/acme-tasks/src/server.ts",
|
|
606
|
-
"sha256": "
|
|
606
|
+
"sha256": "0abd695218d0fd73abde31b2ea16742a028721044ef3c565bdc88cdbb10f19aa",
|
|
607
607
|
"agentTarget": "claude-code"
|
|
608
608
|
},
|
|
609
609
|
{
|
|
@@ -653,7 +653,7 @@
|
|
|
653
653
|
},
|
|
654
654
|
{
|
|
655
655
|
"path": "skills/claude-code/examples/food-ordering/README.md",
|
|
656
|
-
"sha256": "
|
|
656
|
+
"sha256": "013e0734831996d692c3ec314c7457156818089ace8e39ab79a5bf6d74262631",
|
|
657
657
|
"agentTarget": "claude-code"
|
|
658
658
|
},
|
|
659
659
|
{
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@noodleseed/agent-kit",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.30.0",
|
|
4
4
|
"private": false,
|
|
5
5
|
"description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -30,6 +30,10 @@ on the flows.
|
|
|
30
30
|
invents a task.
|
|
31
31
|
- **Two users** — tools are atomic and model-fillable ("high priority" → `priority: "high"`), and each
|
|
32
32
|
returns a spoken-ready status so the model can confirm in one turn.
|
|
33
|
+
- **Cross-host confirmation** — `complete_task` keeps `confirm: true`. The server's explicit
|
|
34
|
+
`interactions.confirmationFallback: 'host'` uses Noodle confirmation in capable/embedded hosts and trusts
|
|
35
|
+
ChatGPT's native write approval only when the stateless transport cannot present that form. Backend
|
|
36
|
+
authorization remains independent.
|
|
33
37
|
|
|
34
38
|
## Wireframe (one screen: the three flows in place)
|
|
35
39
|
|
|
@@ -43,6 +43,9 @@ export default server(
|
|
|
43
43
|
{
|
|
44
44
|
title: 'Acme Tasks',
|
|
45
45
|
version: '1.0.0',
|
|
46
|
+
// ChatGPT's stateless MCP lane cannot carry Noodle's standard confirmation form. Keep
|
|
47
|
+
// confirm:true for capable/embedded hosts, but explicitly trust native host approval there.
|
|
48
|
+
interactions: { confirmationFallback: 'host' },
|
|
46
49
|
branding: {
|
|
47
50
|
name: 'Acme Tasks',
|
|
48
51
|
accent: '#7C3AED',
|
|
@@ -20,7 +20,7 @@ private customer data.
|
|
|
20
20
|
| React app runtime kit | `@noodleseed/one/react` supplies app flow, shell/nav/view, async state, form, quantity, choice, and handoff primitives |
|
|
21
21
|
| Multi-step widget flow | One React shell navigates stores, menu, item customization, cart, review, and handoff views through `useAppFlow` |
|
|
22
22
|
| Invocation context | `server.context` sets locale/time-zone defaults, derives an ambient service area/date, and makes the same snapshot available to tools and the reserved `noodle_context` MCP adapter |
|
|
23
|
-
| Structured missing input | `plan_order` uses `ctx.elicit` to collect a fulfilment method and date
|
|
23
|
+
| Structured missing input | `plan_order` uses `ctx.elicit` to collect a fulfilment method and date through embedded/headless forms, standard bidirectional elicitation, a linked MCP App form, or an exact structured conversational retry on stateless hosts |
|
|
24
24
|
| Model-visible widget state | `useUpdateModelContext` publishes one cohesive replacement snapshot when supported; `useWidgetLifecycle` auto-publishes mounted/cancelled/dismissed and reports author-owned submitted milestones for future context (not host-presentation proof), while the user-triggered submit pairs `useSendFollowUpMessage` for an immediate reply |
|
|
25
25
|
| Handoff | `handoff.allowedDomains` allows only `https://orders.example.com` checkout URLs |
|
|
26
26
|
| Progressive enhancement | Non-Apps hosts still receive stores, featured items, and a readable fallback summary |
|
|
@@ -34,7 +34,8 @@ Like the comprehensive default `noodle init my-app` scaffold, this flagship keep
|
|
|
34
34
|
while making each individual widget view focused; server capability breadth and screen density are separate.
|
|
35
35
|
The compiled initial widget should normally remain under the 1 MiB performance recommendation; Noodle Seed's
|
|
36
36
|
hard ceilings are 10 MiB per compiled widget and 20 MiB across one deployment. Run `noodle check` to see raw
|
|
37
|
-
and gzip-estimated sizes
|
|
37
|
+
and gzip-estimated sizes. Deploy requests are gzip-compressed as one stream so repeated self-contained React
|
|
38
|
+
runtime bytes deduplicate on the wire without a cross-tenant CDN. Keep menu images or large live datasets in assets/resources and app-only tools
|
|
38
39
|
rather than embedding them into the initial HTML bundle.
|
|
39
40
|
|
|
40
41
|
## Local Author Loop
|
|
@@ -273,7 +273,7 @@ tool('prepare_time_off', {
|
|
|
273
273
|
});
|
|
274
274
|
```
|
|
275
275
|
|
|
276
|
-
Use a stable lowercase/number/underscore id and a flat form of string/number/integer/boolean, string choices or multi-select, with optional `email`, `uri`, `date`, or `date-time` formats. Nested objects and credential-shaped fields fail with `invalid_elicitation_schema`. Every interactive flow must place all `ctx.elicit` calls before its first connector operation or compilation fails with `invalid_elicitation_flow`. Embedded/headless clients receive `input_requested`; bidirectional MCP transports map the primitive to standard form `elicitation/create`.
|
|
276
|
+
Use a stable lowercase/number/underscore id and a flat form of string/number/integer/boolean, string choices or multi-select, with optional `email`, `uri`, `date`, or `date-time` formats. Nested objects and credential-shaped fields fail with `invalid_elicitation_schema`. Every interactive flow must place all `ctx.elicit` calls before its first connector operation or compilation fails with `invalid_elicitation_flow`. Embedded/headless clients receive `input_requested`; bidirectional MCP transports map the primitive to standard form `elicitation/create`. On stateless hosts, the adapter returns a structured non-executing `interaction_unavailable` result; linked Apps render its business-user form and retry in request `_meta`, while models can use the advertised reserved retry field. Accept validates and replays only the operation-free input prefix; invalid content returns `arg_invalid`, and decline/cancel stop. Elicitation gathers missing input and does not replace confirmation. In a flow marked `confirm: true`, every eligible `input_requested` precedes `tool_proposed`; the final proposal reviews the original input, elicited values, and sole exact connector action. Accept is bound to that action and only then may execution start. A confirmable flow may contain at most one connector operation; additional operations fail with `invalid_confirmation_flow`. MCP uses final standard form confirmation on capable bidirectional transports and fails closed otherwise. Setting `interactions: { confirmationFallback: "host" }` in the server options explicitly trusts native host approval only when confirmation transport is unavailable and after every elicited field is collected; it is never inferred from client name and does not replace authorization. Omitted or `false` annotations execute directly; hints alone never gate. `annotations.action({ confirm: true })` explicitly enables confirmation; `annotations.action({ confirm: false })` explicitly preserves direct execution.
|
|
277
277
|
|
|
278
278
|
## Compute connector example
|
|
279
279
|
|
|
@@ -120,6 +120,14 @@ noodle assistant clients create --name web --org <org> --app <app> --env <env>
|
|
|
120
120
|
|
|
121
121
|
The CLI writes `{ clientId, clientSecret }` to a mode-`0600` file and prints only its path. Move the values into the SaaS backend secret manager without printing or committing them. Rotation invalidates the previous secret.
|
|
122
122
|
|
|
123
|
+
Validate the active deployment, backend credential, exact origin, and delegated credential exchanges without invoking a business tool:
|
|
124
|
+
|
|
125
|
+
```sh
|
|
126
|
+
noodle assistant doctor --origin "$PUBLIC_APP_ORIGIN" --org <org> --app <app> --env <env>
|
|
127
|
+
```
|
|
128
|
+
|
|
129
|
+
The doctor reads `NOODLE_ASSISTANT_CLIENT_ID` / `NOODLE_ASSISTANT_CLIENT_SECRET` or the saved mode-0600 client file and never prints the secret. Pass `--user-id <real-test-user>` only when the downstream exchange requires an existing application user.
|
|
130
|
+
|
|
123
131
|
## Integrate the customer backend
|
|
124
132
|
|
|
125
133
|
Read the customer repository lockfile or `packageManager` field and install `@noodleseed/assistant` with that existing package manager; never introduce a second lockfile.
|
|
@@ -176,7 +184,7 @@ The callback records declarative fulfilment at author time; the shared runtime e
|
|
|
176
184
|
|
|
177
185
|
## Structured missing input
|
|
178
186
|
|
|
179
|
-
A tool authored with `ctx.elicit({ id, message, input })` produces `input_requested` when it reaches
|
|
187
|
+
A tool authored with `ctx.elicit({ id, message, input })` produces `input_requested` when it reaches missing input. Built-in and headless renderers present it and call `respond(id, { action: "accept", content })`; decline/cancel stop. Accepted content is schema-validated and completed steps are not rerun; invalid content returns `arg_invalid` and keeps the interaction pending. Elicitation gathers an input and does not approve a later write. Every interactive flow collects elicited input before its first connector operation; every eligible `input_requested` precedes `tool_proposed`. In a `confirm: true` flow, the final proposal reviews original input, elicited values, and the sole exact connector action; a confirmable flow has at most one connector operation. Accept is bound to that action. Bidirectional MCP maps missing input to standard `elicitation/create`. On a stateless host, a linked MCP App presents the same normal-user form and re-calls the tool through standard `tools/call`, carrying replay answers in request `_meta` so approval copy contains only business fields; without Apps, the model receives the exact structured schema and an advertised reserved retry field. Both paths replay only the operation-free input prefix and never expose runtime continuation or environment state. Setting `interactions: { confirmationFallback: "host" }` explicitly trusts native host approval only after every elicited field is collected and only when confirmation transport is unavailable; embedded/headless confirmation remains Noodle-owned. Omitted or false annotations execute directly; hints never gate.
|
|
180
188
|
|
|
181
189
|
## Verified session context (identity and claims)
|
|
182
190
|
|
|
@@ -283,7 +291,7 @@ if (pendingId) {
|
|
|
283
291
|
|
|
284
292
|
`view_available` means a completed tool has a linked MCP App view. It carries the call/interaction id, tool, `ui://` identity, optional title, bounded/redacted public result, and—on current services—the self-contained bridged document. The standard element is an MCP Apps host and mounts that document behind a double iframe. It supports lifecycle, app tool/resource calls, ui/message, ui/update-model-context, links, resize, and inline/fullscreen; sampling, tasks, downloads, and remote DOM are not advertised. It also dispatches `assistant-view-available` for a customer-owned renderer.
|
|
285
293
|
|
|
286
|
-
`clientContext` and typed `pageContext` are recomputed for each turn. `updateContext(...)` remains the legacy session-exchange context; `updatePageContext(...)` replaces the fresh per-turn application hint. `updateModelContext({ content, structuredContent })` publishes one cohesive renderer snapshot for later message turns without starting a turn; every call replaces the prior snapshot rather than merging fields. These are untrusted data, not conversation history or authorization input, and the boundaries reject credential-shaped or unbounded updates. A message may re-exchange once after a pre-execution `401`; the client never auto-retries interaction decisions. `tool_proposed.arguments` is a complete schema-aware review projection and, for connector-backed tools, names the sole exact connector version
|
|
294
|
+
`clientContext` and typed `pageContext` are recomputed for each turn. `updateContext(...)` remains the legacy session-exchange context; `updatePageContext(...)` replaces the fresh per-turn application hint. `updateModelContext({ content, structuredContent })` publishes one cohesive renderer snapshot for later message turns without starting a turn; every call replaces the prior snapshot rather than merging fields. These are untrusted data, not conversation history or authorization input, and the boundaries reject credential-shaped or unbounded updates. A message may re-exchange once after a pre-execution `401`; the client never auto-retries interaction decisions. `tool_proposed.arguments` is a complete schema-aware review projection and, for connector-backed tools, names the sole exact connector version/operation/resolved arguments. Sensitive/write-only fields are redacted; truncating or omitting any non-sensitive action field fails closed. Accept is bound to the server-held action and claims at most one execution attempt—clients cannot replace it. Normal terminal outcomes scrub private arguments and continuations immediately; only an accepted action still executing retains them for the one-hour unknown-outcome recovery window, after which it records `interaction_outcome_unknown` and scrubs. Without downstream idempotency this is not an exactly-once business-effect guarantee. To reconcile a lost response, explicitly repeat the same id and decision: the service returns its durable stored outcome without re-execution.
|
|
287
295
|
|
|
288
296
|
## Toolchain requirements
|
|
289
297
|
|
|
@@ -127,7 +127,7 @@ prompt('summarize_ticket', {
|
|
|
127
127
|
|
|
128
128
|
### Non-trivial tool: ctx connectors, annotations, visibility, async
|
|
129
129
|
|
|
130
|
-
`ctx` is `{ input, user, connectors }`. Bind connectors with `use` on the server, then call one inside `fulfil` to record a step. `annotations.readOnly()` declares a closed-world safe read. TypeScript action helpers enforce confirmation only with `{ confirm: true }`; omitted or `false` executes directly, and action/destructive/open-world hints alone never enable the gate. `visibility` defaults to `['model', 'app']` — set `['app']` to hide a helper from the model. `fulfil` may be `async` (the compiler awaits it while recording).
|
|
130
|
+
`ctx` is `{ input, user, connectors }`. Bind connectors with `use` on the server, then call one inside `fulfil` to record a step. `annotations.readOnly()` declares a closed-world safe read. TypeScript action helpers enforce confirmation only with `{ confirm: true }`; omitted or `false` executes directly, and action/destructive/open-world hints alone never enable the gate. For stateless hosts that cannot present Noodle confirmation, set `interactions: { confirmationFallback: 'host' }` in the `server` options to explicitly trust native host write approval; omission remains fail-closed and the fallback never supplies missing `ctx.elicit` input. `visibility` defaults to `['model', 'app']` — set `['app']` to hide a helper from the model. `fulfil` may be `async` (the compiler awaits it while recording).
|
|
131
131
|
|
|
132
132
|
```ts
|
|
133
133
|
import { annotations, connector, server, tool, z } from '@noodleseed/one';
|
package/skills/codex/SKILL.md
CHANGED
|
@@ -30,6 +30,10 @@ on the flows.
|
|
|
30
30
|
invents a task.
|
|
31
31
|
- **Two users** — tools are atomic and model-fillable ("high priority" → `priority: "high"`), and each
|
|
32
32
|
returns a spoken-ready status so the model can confirm in one turn.
|
|
33
|
+
- **Cross-host confirmation** — `complete_task` keeps `confirm: true`. The server's explicit
|
|
34
|
+
`interactions.confirmationFallback: 'host'` uses Noodle confirmation in capable/embedded hosts and trusts
|
|
35
|
+
ChatGPT's native write approval only when the stateless transport cannot present that form. Backend
|
|
36
|
+
authorization remains independent.
|
|
33
37
|
|
|
34
38
|
## Wireframe (one screen: the three flows in place)
|
|
35
39
|
|
|
@@ -43,6 +43,9 @@ export default server(
|
|
|
43
43
|
{
|
|
44
44
|
title: 'Acme Tasks',
|
|
45
45
|
version: '1.0.0',
|
|
46
|
+
// ChatGPT's stateless MCP lane cannot carry Noodle's standard confirmation form. Keep
|
|
47
|
+
// confirm:true for capable/embedded hosts, but explicitly trust native host approval there.
|
|
48
|
+
interactions: { confirmationFallback: 'host' },
|
|
46
49
|
branding: {
|
|
47
50
|
name: 'Acme Tasks',
|
|
48
51
|
accent: '#7C3AED',
|
|
@@ -20,7 +20,7 @@ private customer data.
|
|
|
20
20
|
| React app runtime kit | `@noodleseed/one/react` supplies app flow, shell/nav/view, async state, form, quantity, choice, and handoff primitives |
|
|
21
21
|
| Multi-step widget flow | One React shell navigates stores, menu, item customization, cart, review, and handoff views through `useAppFlow` |
|
|
22
22
|
| Invocation context | `server.context` sets locale/time-zone defaults, derives an ambient service area/date, and makes the same snapshot available to tools and the reserved `noodle_context` MCP adapter |
|
|
23
|
-
| Structured missing input | `plan_order` uses `ctx.elicit` to collect a fulfilment method and date
|
|
23
|
+
| Structured missing input | `plan_order` uses `ctx.elicit` to collect a fulfilment method and date through embedded/headless forms, standard bidirectional elicitation, a linked MCP App form, or an exact structured conversational retry on stateless hosts |
|
|
24
24
|
| Model-visible widget state | `useUpdateModelContext` publishes one cohesive replacement snapshot when supported; `useWidgetLifecycle` auto-publishes mounted/cancelled/dismissed and reports author-owned submitted milestones for future context (not host-presentation proof), while the user-triggered submit pairs `useSendFollowUpMessage` for an immediate reply |
|
|
25
25
|
| Handoff | `handoff.allowedDomains` allows only `https://orders.example.com` checkout URLs |
|
|
26
26
|
| Progressive enhancement | Non-Apps hosts still receive stores, featured items, and a readable fallback summary |
|
|
@@ -34,7 +34,8 @@ Like the comprehensive default `noodle init my-app` scaffold, this flagship keep
|
|
|
34
34
|
while making each individual widget view focused; server capability breadth and screen density are separate.
|
|
35
35
|
The compiled initial widget should normally remain under the 1 MiB performance recommendation; Noodle Seed's
|
|
36
36
|
hard ceilings are 10 MiB per compiled widget and 20 MiB across one deployment. Run `noodle check` to see raw
|
|
37
|
-
and gzip-estimated sizes
|
|
37
|
+
and gzip-estimated sizes. Deploy requests are gzip-compressed as one stream so repeated self-contained React
|
|
38
|
+
runtime bytes deduplicate on the wire without a cross-tenant CDN. Keep menu images or large live datasets in assets/resources and app-only tools
|
|
38
39
|
rather than embedding them into the initial HTML bundle.
|
|
39
40
|
|
|
40
41
|
## Local Author Loop
|
|
@@ -273,7 +273,7 @@ tool('prepare_time_off', {
|
|
|
273
273
|
});
|
|
274
274
|
```
|
|
275
275
|
|
|
276
|
-
Use a stable lowercase/number/underscore id and a flat form of string/number/integer/boolean, string choices or multi-select, with optional `email`, `uri`, `date`, or `date-time` formats. Nested objects and credential-shaped fields fail with `invalid_elicitation_schema`. Every interactive flow must place all `ctx.elicit` calls before its first connector operation or compilation fails with `invalid_elicitation_flow`. Embedded/headless clients receive `input_requested`; bidirectional MCP transports map the primitive to standard form `elicitation/create`.
|
|
276
|
+
Use a stable lowercase/number/underscore id and a flat form of string/number/integer/boolean, string choices or multi-select, with optional `email`, `uri`, `date`, or `date-time` formats. Nested objects and credential-shaped fields fail with `invalid_elicitation_schema`. Every interactive flow must place all `ctx.elicit` calls before its first connector operation or compilation fails with `invalid_elicitation_flow`. Embedded/headless clients receive `input_requested`; bidirectional MCP transports map the primitive to standard form `elicitation/create`. On stateless hosts, the adapter returns a structured non-executing `interaction_unavailable` result; linked Apps render its business-user form and retry in request `_meta`, while models can use the advertised reserved retry field. Accept validates and replays only the operation-free input prefix; invalid content returns `arg_invalid`, and decline/cancel stop. Elicitation gathers missing input and does not replace confirmation. In a flow marked `confirm: true`, every eligible `input_requested` precedes `tool_proposed`; the final proposal reviews the original input, elicited values, and sole exact connector action. Accept is bound to that action and only then may execution start. A confirmable flow may contain at most one connector operation; additional operations fail with `invalid_confirmation_flow`. MCP uses final standard form confirmation on capable bidirectional transports and fails closed otherwise. Setting `interactions: { confirmationFallback: "host" }` in the server options explicitly trusts native host approval only when confirmation transport is unavailable and after every elicited field is collected; it is never inferred from client name and does not replace authorization. Omitted or `false` annotations execute directly; hints alone never gate. `annotations.action({ confirm: true })` explicitly enables confirmation; `annotations.action({ confirm: false })` explicitly preserves direct execution.
|
|
277
277
|
|
|
278
278
|
## Compute connector example
|
|
279
279
|
|
|
@@ -120,6 +120,14 @@ noodle assistant clients create --name web --org <org> --app <app> --env <env>
|
|
|
120
120
|
|
|
121
121
|
The CLI writes `{ clientId, clientSecret }` to a mode-`0600` file and prints only its path. Move the values into the SaaS backend secret manager without printing or committing them. Rotation invalidates the previous secret.
|
|
122
122
|
|
|
123
|
+
Validate the active deployment, backend credential, exact origin, and delegated credential exchanges without invoking a business tool:
|
|
124
|
+
|
|
125
|
+
```sh
|
|
126
|
+
noodle assistant doctor --origin "$PUBLIC_APP_ORIGIN" --org <org> --app <app> --env <env>
|
|
127
|
+
```
|
|
128
|
+
|
|
129
|
+
The doctor reads `NOODLE_ASSISTANT_CLIENT_ID` / `NOODLE_ASSISTANT_CLIENT_SECRET` or the saved mode-0600 client file and never prints the secret. Pass `--user-id <real-test-user>` only when the downstream exchange requires an existing application user.
|
|
130
|
+
|
|
123
131
|
## Integrate the customer backend
|
|
124
132
|
|
|
125
133
|
Read the customer repository lockfile or `packageManager` field and install `@noodleseed/assistant` with that existing package manager; never introduce a second lockfile.
|
|
@@ -176,7 +184,7 @@ The callback records declarative fulfilment at author time; the shared runtime e
|
|
|
176
184
|
|
|
177
185
|
## Structured missing input
|
|
178
186
|
|
|
179
|
-
A tool authored with `ctx.elicit({ id, message, input })` produces `input_requested` when it reaches
|
|
187
|
+
A tool authored with `ctx.elicit({ id, message, input })` produces `input_requested` when it reaches missing input. Built-in and headless renderers present it and call `respond(id, { action: "accept", content })`; decline/cancel stop. Accepted content is schema-validated and completed steps are not rerun; invalid content returns `arg_invalid` and keeps the interaction pending. Elicitation gathers an input and does not approve a later write. Every interactive flow collects elicited input before its first connector operation; every eligible `input_requested` precedes `tool_proposed`. In a `confirm: true` flow, the final proposal reviews original input, elicited values, and the sole exact connector action; a confirmable flow has at most one connector operation. Accept is bound to that action. Bidirectional MCP maps missing input to standard `elicitation/create`. On a stateless host, a linked MCP App presents the same normal-user form and re-calls the tool through standard `tools/call`, carrying replay answers in request `_meta` so approval copy contains only business fields; without Apps, the model receives the exact structured schema and an advertised reserved retry field. Both paths replay only the operation-free input prefix and never expose runtime continuation or environment state. Setting `interactions: { confirmationFallback: "host" }` explicitly trusts native host approval only after every elicited field is collected and only when confirmation transport is unavailable; embedded/headless confirmation remains Noodle-owned. Omitted or false annotations execute directly; hints never gate.
|
|
180
188
|
|
|
181
189
|
## Verified session context (identity and claims)
|
|
182
190
|
|
|
@@ -283,7 +291,7 @@ if (pendingId) {
|
|
|
283
291
|
|
|
284
292
|
`view_available` means a completed tool has a linked MCP App view. It carries the call/interaction id, tool, `ui://` identity, optional title, bounded/redacted public result, and—on current services—the self-contained bridged document. The standard element is an MCP Apps host and mounts that document behind a double iframe. It supports lifecycle, app tool/resource calls, ui/message, ui/update-model-context, links, resize, and inline/fullscreen; sampling, tasks, downloads, and remote DOM are not advertised. It also dispatches `assistant-view-available` for a customer-owned renderer.
|
|
285
293
|
|
|
286
|
-
`clientContext` and typed `pageContext` are recomputed for each turn. `updateContext(...)` remains the legacy session-exchange context; `updatePageContext(...)` replaces the fresh per-turn application hint. `updateModelContext({ content, structuredContent })` publishes one cohesive renderer snapshot for later message turns without starting a turn; every call replaces the prior snapshot rather than merging fields. These are untrusted data, not conversation history or authorization input, and the boundaries reject credential-shaped or unbounded updates. A message may re-exchange once after a pre-execution `401`; the client never auto-retries interaction decisions. `tool_proposed.arguments` is a complete schema-aware review projection and, for connector-backed tools, names the sole exact connector version
|
|
294
|
+
`clientContext` and typed `pageContext` are recomputed for each turn. `updateContext(...)` remains the legacy session-exchange context; `updatePageContext(...)` replaces the fresh per-turn application hint. `updateModelContext({ content, structuredContent })` publishes one cohesive renderer snapshot for later message turns without starting a turn; every call replaces the prior snapshot rather than merging fields. These are untrusted data, not conversation history or authorization input, and the boundaries reject credential-shaped or unbounded updates. A message may re-exchange once after a pre-execution `401`; the client never auto-retries interaction decisions. `tool_proposed.arguments` is a complete schema-aware review projection and, for connector-backed tools, names the sole exact connector version/operation/resolved arguments. Sensitive/write-only fields are redacted; truncating or omitting any non-sensitive action field fails closed. Accept is bound to the server-held action and claims at most one execution attempt—clients cannot replace it. Normal terminal outcomes scrub private arguments and continuations immediately; only an accepted action still executing retains them for the one-hour unknown-outcome recovery window, after which it records `interaction_outcome_unknown` and scrubs. Without downstream idempotency this is not an exactly-once business-effect guarantee. To reconcile a lost response, explicitly repeat the same id and decision: the service returns its durable stored outcome without re-execution.
|
|
287
295
|
|
|
288
296
|
## Toolchain requirements
|
|
289
297
|
|
|
@@ -127,7 +127,7 @@ prompt('summarize_ticket', {
|
|
|
127
127
|
|
|
128
128
|
### Non-trivial tool: ctx connectors, annotations, visibility, async
|
|
129
129
|
|
|
130
|
-
`ctx` is `{ input, user, connectors }`. Bind connectors with `use` on the server, then call one inside `fulfil` to record a step. `annotations.readOnly()` declares a closed-world safe read. TypeScript action helpers enforce confirmation only with `{ confirm: true }`; omitted or `false` executes directly, and action/destructive/open-world hints alone never enable the gate. `visibility` defaults to `['model', 'app']` — set `['app']` to hide a helper from the model. `fulfil` may be `async` (the compiler awaits it while recording).
|
|
130
|
+
`ctx` is `{ input, user, connectors }`. Bind connectors with `use` on the server, then call one inside `fulfil` to record a step. `annotations.readOnly()` declares a closed-world safe read. TypeScript action helpers enforce confirmation only with `{ confirm: true }`; omitted or `false` executes directly, and action/destructive/open-world hints alone never enable the gate. For stateless hosts that cannot present Noodle confirmation, set `interactions: { confirmationFallback: 'host' }` in the `server` options to explicitly trust native host write approval; omission remains fail-closed and the fallback never supplies missing `ctx.elicit` input. `visibility` defaults to `['model', 'app']` — set `['app']` to hide a helper from the model. `fulfil` may be `async` (the compiler awaits it while recording).
|
|
131
131
|
|
|
132
132
|
```ts
|
|
133
133
|
import { annotations, connector, server, tool, z } from '@noodleseed/one';
|