@noodleseed/agent-kit 0.30.1 → 0.32.0

package/manifest.json

@@ -1,9 +1,9 @@
 {
-  "packageVersion": "0.30.1",
+  "packageVersion": "0.32.0",
   "files": [
     {
       "path": "skills/codex/SKILL.md",
-      "sha256": "4e2de1199627d9a194ed2ae0985f440288f895ee82ae65935ebf37385affe6c6",
+      "sha256": "5f2acbe3b06a5bb88629267f361331c3644378ebd90741db7a1c6c1ce0a257df",
       "agentTarget": "codex"
     },
     {
@@ -13,7 +13,7 @@
     },
     {
       "path": "skills/codex/references/cli-commands.md",
-      "sha256": "40985b107f9166ee7f199f97dd2c02c1b4232aa523a245a945fea9d345f8fca0",
+      "sha256": "8d3a9aa1d68b7d5edc72605cc1f2b33e63b938ce768531fcc43cf681a264921e",
       "agentTarget": "codex"
     },
     {
@@ -63,7 +63,7 @@
     },
     {
       "path": "skills/codex/references/deploy-and-ops.md",
-      "sha256": "d029cb301ae2d06337f573a356c98106f283a1ef8f5f905fb63fe4d4bdf5c599",
+      "sha256": "17d56c27d31caf3792e16d8462986b4624335480d22a2e1483fe21745d0bd56c",
       "agentTarget": "codex"
     },
     {
@@ -81,6 +81,11 @@
       "sha256": "69ab3b0e85454f3d5df5f270b760216de7b1a69803a2f081447bc27bb634c524",
       "agentTarget": "codex"
     },
+    {
+      "path": "skills/codex/references/feedback.md",
+      "sha256": "114e6825123a0a0496b4909d9898f539fd2706af806c5882b10d0a941835a1c8",
+      "agentTarget": "codex"
+    },
     {
       "path": "skills/codex/examples/acme-bistro/README.md",
       "sha256": "2bcf803ea2407479ddc70644a79ad503335880fd8439ed673b17c8d50e7cb59f",
@@ -328,7 +333,7 @@
     },
     {
       "path": "skills/codex/examples/hello/README.md",
-      "sha256": "c39b89f95c4ae1a2b78a71f42c00910507c32eaba628be36e5ec3ef32508aaa5",
+      "sha256": "82fbbaa49e6eae064fffb4ea59a45a17cf350075780ff3e386b92b7f72a8201d",
       "agentTarget": "codex"
     },
     {
@@ -378,7 +383,7 @@
     },
     {
       "path": "skills/claude-code/SKILL.md",
-      "sha256": "ed60e53c77c3e71d162ab1040c75ad648e51d7c7ccf867794801216afe246651",
+      "sha256": "5c4f947b83e99e5b0c536ed243ba6702041e7f93d3aff091405b8f4109779a9e",
       "agentTarget": "claude-code"
     },
     {
@@ -388,7 +393,7 @@
     },
     {
       "path": "skills/claude-code/references/cli-commands.md",
-      "sha256": "40985b107f9166ee7f199f97dd2c02c1b4232aa523a245a945fea9d345f8fca0",
+      "sha256": "8d3a9aa1d68b7d5edc72605cc1f2b33e63b938ce768531fcc43cf681a264921e",
       "agentTarget": "claude-code"
     },
     {
@@ -438,7 +443,7 @@
     },
     {
       "path": "skills/claude-code/references/deploy-and-ops.md",
-      "sha256": "d029cb301ae2d06337f573a356c98106f283a1ef8f5f905fb63fe4d4bdf5c599",
+      "sha256": "17d56c27d31caf3792e16d8462986b4624335480d22a2e1483fe21745d0bd56c",
       "agentTarget": "claude-code"
     },
     {
@@ -456,6 +461,11 @@
       "sha256": "69ab3b0e85454f3d5df5f270b760216de7b1a69803a2f081447bc27bb634c524",
       "agentTarget": "claude-code"
     },
+    {
+      "path": "skills/claude-code/references/feedback.md",
+      "sha256": "114e6825123a0a0496b4909d9898f539fd2706af806c5882b10d0a941835a1c8",
+      "agentTarget": "claude-code"
+    },
     {
       "path": "skills/claude-code/examples/acme-bistro/README.md",
       "sha256": "2bcf803ea2407479ddc70644a79ad503335880fd8439ed673b17c8d50e7cb59f",
@@ -703,7 +713,7 @@
     },
     {
       "path": "skills/claude-code/examples/hello/README.md",
-      "sha256": "c39b89f95c4ae1a2b78a71f42c00910507c32eaba628be36e5ec3ef32508aaa5",
+      "sha256": "82fbbaa49e6eae064fffb4ea59a45a17cf350075780ff3e386b92b7f72a8201d",
       "agentTarget": "claude-code"
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/agent-kit",
-  "version": "0.30.1",
+  "version": "0.32.0",
   "private": false,
   "description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
   "license": "Apache-2.0",
@@ -33,6 +33,7 @@
     "mcp",
     "agent-skills",
     "codex",
-    "claude-code"
+    "claude-code",
+    "cursor"
   ]
 }

package/skills/claude-code/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: noodle-seed
 description: Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI.
-version: 0.30.1
-hash: d16ddb93b02b757a
+version: 0.32.0
+hash: 9e69b4cf0440dc2d
 ---
 
 # Noodle Seed
@@ -11,6 +11,8 @@ Build, validate, test, deploy, and operate Noodle Seed MCP servers and apps auth
 
 Use this skill for project-local Noodle Seed authoring in Claude Code; preserve generated/user instruction boundaries.
 
+**Installed-plugin execution.** When this skill is supplied by the Noodle Developer plugin, preserve the managed invocation path established by the plugin bootstrap and invoke every `noodle` command through that host bundle's managed launcher. Do not install or update a global CLI. Noodle guides and operates the lifecycle; you write and test the application source in the user's project.
+
 ## Golden path
 
 This CLI is agent-native: the cold-agent-path commands speak the `--json` envelope (hosted admin/ops commands are still being normalized). Drive the loop by parsing machine state, not human prose. The full envelope, exit codes, and output modes are in `references/agent-contract.md`.
@@ -49,6 +51,11 @@ Scan all of these during discovery; open in full the ones your task touches:
 - `references/publishing.md` — submit to the ChatGPT apps directory and Claude connectors directory.
 - `references/chatgpt-compliance.md` — the OpenAI Apps SDK pre-submission checklist (beyond the metadata gate): conversational value, helpful-UI-only, in-chat completion, UI guidelines, domain guardrails, privacy.
 - `references/examples.md` — flagship example index and a canonical `server.ts`.
+- `references/feedback.md` — send sanitized product feedback to the Noodle Seed team with `noodle feedback`, proactively, whenever you discover a bug, gap, or improvement.
+
+## Product feedback
+
+When you discover a bug, missing capability, misleading doc, or improvement idea in the CLI, SDK, or any part of Noodle Seed, send it in the moment with `noodle feedback` — sanitized per `references/feedback.md` (never customer code, secrets, or personal data), one submission per finding.
 
 ## Safety
 

package/skills/claude-code/examples/hello/README.md

@@ -5,6 +5,11 @@ connectors, secrets, flows, widgets, or handoff policy. It still uses the curren
 so new authors see where server-level branding belongs. Use it to smoke the author loop
 (`noodle validate` / `noodle dev`) or a first deploy.
 
+When an installed Noodle Developer plugin drives this example, its skill runs these logical
+`noodle` commands through the plugin-managed, version-pinned launcher and isolated host profile.
+Do not install or update a global CLI: the coding agent writes and tests this source while Noodle
+guides and operates the validate, preview, deploy, inspect, and debug workflow.
+
 ```sh
 noodle dev examples/hello/src/server.ts --app hello
 noodle deploy examples/hello/src/server.ts --org acme --app hello

package/skills/claude-code/references/cli-commands.md

@@ -63,6 +63,7 @@ Every `noodle` command, grouped by area. Local authoring commands (`validate`, `
 | `noodle login` | Authenticate with Noodle Seed Cloud. |
 | `noodle logout` | Clear saved credentials. |
 | `noodle whoami` | Print the current authenticated user. |
+| `noodle feedback` | Send sanitized product feedback (bug, idea, docs gap) to the Noodle Seed team. |
 | `noodle list` | Removed — promoted to `deployments list` (prints the recovery pointer and exits 2). |
 | `noodle github` | Connect, inspect, or disconnect the GitHub repository behind an app’s GitHub-native deploys (`connect`/`status`/`disconnect`; `connect` opens a browser install, `--repo` for headless). |
 | `noodle target` | Show or set the deployment target (local\|cloud\|other). |

package/skills/claude-code/references/deploy-and-ops.md

@@ -5,6 +5,7 @@
 - Authenticate
 - Link and target
 - Deploy and inspect
+- Installed Developer plugin handoff
 - Eject path (portable manifest)
 - Connect into a host
 - Access modes
@@ -25,6 +26,10 @@
 
 `noodle deploy` deploys the server. Then `noodle open` (latest URL), `noodle status`, `noodle inspect` (metadata, no secrets), `noodle smoke` (readiness diagnostics), and `noodle rollback <deploymentId>` to revert.
 
+## Installed Developer plugin handoff
+
+When this project was bootstrapped by the installed Noodle Developer plugin, preserve its managed launcher invocation for every local CLI command. After `deploy --json`, take the returned deployment ID to the connected remote `noodle-developer.inspect_deployment` tool. Use `noodle-developer.diagnose_app` only when the Cloud evidence needs diagnosis. Those tools inspect the selected organization and environment; they do not edit or replace the application source, which remains the coding agent's responsibility.
+
 ## Eject path (portable manifest)
 
 `noodle export manifest [--output <file>]` compiles the entrypoint locally and emits the portable, vendor-neutral manifest JSON — no service, no login, no account. A Noodle app is just `src/server.ts` plus this manifest: the user can read it, diff it, and keep it.

package/skills/claude-code/references/feedback.md

@@ -0,0 +1,67 @@
+# Send product feedback
+
+When you — the coding agent — discover a way Noodle Seed could be better, tell the team with one command. Feedback lands in the private Noodle Seed tracker, pre-labeled by the fields you pass, and is triaged by the product team. Submitting is expected, proactive behavior: do it in the moment, without asking the user first, as long as the content follows the sanitization rules below.
+
+## Contents
+
+- When to send feedback (proactive triggers)
+- The command
+- Choose the structured fields
+- Sanitization rules (hard requirements)
+- Minimal repro guidance
+- After you submit
+
+## When to send feedback (proactive triggers)
+
+Send one `noodle feedback` per distinct finding whenever you:
+
+- hit a CLI or SDK error that cost you retries, or whose message/`fix`/`next` guidance misled you;
+- discover a missing capability you had to work around (in the CLI, SDK, widgets, connectors, deploy lane, console, or docs);
+- find documentation, an example, or a skill reference that contradicts observed behavior;
+- notice confusing command output, a broken `--json` envelope, or a wrong exit code;
+- have a concrete idea that would make authoring or operating apps faster.
+
+Do not batch several findings into one submission, and do not re-submit the same finding in the same session. Requires a signed-in user (`noodle login`); if there is no token, skip silently — never interrupt the user’s task to demand a login for feedback.
+
+## The command
+
+```sh
+noodle feedback "resources list --json omits the truncated flag the docs promise" \
+  --title "resources list --json missing truncated flag" \
+  --type fix --severity P2 --area cli --json
+```
+
+The message is required (1–4000 chars). Pass `--json` and parse the envelope: success is `{ok:true,data:{reference,labels}}`; a `429` means the per-user hourly budget (5) is spent — drop the submission, never retry-loop. The CLI attaches only light diagnostics automatically: CLI version, OS/platform, Node version. Nothing else is collected.
+
+## Choose the structured fields
+
+- `--type` — `fix` (bug/regression/wrong output), `feat` (missing capability), `docs` (misleading or absent docs/examples), `chore` (tooling/setup friction). Default `feat`.
+- `--severity` — `P0` only for a security-relevant defect; `P1` a workflow is blocked with no workaround; `P2` blocked but a workaround exists; `P3` (default) papercut or idea.
+- `--area` — one of `docs analytics connectors self-service conformance ci deploys distribution console dx plugins cli compiler multi-surface enterprise policy`. Use `cli` for command behavior, `dx` for authoring/agent ergonomics; omit when unsure.
+- `--title` — one line, ≤120 chars, stating the defect or idea (defaults to the message’s first line).
+
+## Sanitization rules (hard requirements)
+
+Feedback leaves the customer’s environment. NEVER include:
+
+- customer source code, file paths, directory names, or repository names;
+- secrets, tokens, API keys, connection strings, or environment-variable values;
+- personal data (names, emails, user IDs) or customer/business identifiers (org slugs, app slugs, deployment IDs, URLs of deployed apps);
+- verbatim server responses, logs, or error output that could embed any of the above.
+
+Describe the problem generically instead. Rewrite identifiers as placeholders (`<org>`, `my-app`, `EXAMPLE_KEY`). If the evidence cannot be shared without customer data, describe the *shape* of the problem — what you ran, what category of thing went wrong, what you expected — rather than the data itself. When in doubt, leave it out: a vaguer report is always acceptable; a leak never is.
+
+## Minimal repro guidance
+
+A repro is welcome only if it is fully synthetic: a fresh `noodle init` shape, placeholder names, fabricated sample values. State the observed vs. expected behavior in one or two sentences each. Example message:
+
+```text
+Ran a connector tool via `noodle tools call` with a valid local secret; the mapped
+response fields came back undefined even though the raw API returns data.
+Expected the mapping to surface the fields or validate-time to flag the mismatch.
+Repro: applies to every connector whose response mapping references a nested array field.
+```
+
+## After you submit
+
+The returned `reference` (e.g. `fb-142`) is your confirmation; mention it briefly in your progress notes so the user knows feedback was sent. Feedback goes to a private tracker — there is no public issue link, and no follow-up action is needed. Continue the user’s task immediately; feedback must never block or slow their work.

package/skills/codex/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: noodle-seed
 description: Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI.
-version: 0.30.1
-hash: c2a03a8059656742
+version: 0.32.0
+hash: 7228bf705097483b
 ---
 
 # Noodle Seed
@@ -11,6 +11,8 @@ Build, validate, test, deploy, and operate Noodle Seed MCP servers and apps auth
 
 Use this skill for local Noodle Seed project work in Codex.
 
+**Installed-plugin execution.** When this skill is supplied by the Noodle Developer plugin, preserve the managed invocation path established by the plugin bootstrap and invoke every `noodle` command through that host bundle's managed launcher. Do not install or update a global CLI. Noodle guides and operates the lifecycle; you write and test the application source in the user's project.
+
 ## Golden path
 
 This CLI is agent-native: the cold-agent-path commands speak the `--json` envelope (hosted admin/ops commands are still being normalized). Drive the loop by parsing machine state, not human prose. The full envelope, exit codes, and output modes are in `references/agent-contract.md`.
@@ -49,6 +51,11 @@ Scan all of these during discovery; open in full the ones your task touches:
 - `references/publishing.md` — submit to the ChatGPT apps directory and Claude connectors directory.
 - `references/chatgpt-compliance.md` — the OpenAI Apps SDK pre-submission checklist (beyond the metadata gate): conversational value, helpful-UI-only, in-chat completion, UI guidelines, domain guardrails, privacy.
 - `references/examples.md` — flagship example index and a canonical `server.ts`.
+- `references/feedback.md` — send sanitized product feedback to the Noodle Seed team with `noodle feedback`, proactively, whenever you discover a bug, gap, or improvement.
+
+## Product feedback
+
+When you discover a bug, missing capability, misleading doc, or improvement idea in the CLI, SDK, or any part of Noodle Seed, send it in the moment with `noodle feedback` — sanitized per `references/feedback.md` (never customer code, secrets, or personal data), one submission per finding.
 
 ## Safety
 

package/skills/codex/examples/hello/README.md

@@ -5,6 +5,11 @@ connectors, secrets, flows, widgets, or handoff policy. It still uses the curren
 so new authors see where server-level branding belongs. Use it to smoke the author loop
 (`noodle validate` / `noodle dev`) or a first deploy.
 
+When an installed Noodle Developer plugin drives this example, its skill runs these logical
+`noodle` commands through the plugin-managed, version-pinned launcher and isolated host profile.
+Do not install or update a global CLI: the coding agent writes and tests this source while Noodle
+guides and operates the validate, preview, deploy, inspect, and debug workflow.
+
 ```sh
 noodle dev examples/hello/src/server.ts --app hello
 noodle deploy examples/hello/src/server.ts --org acme --app hello

package/skills/codex/references/cli-commands.md

@@ -63,6 +63,7 @@ Every `noodle` command, grouped by area. Local authoring commands (`validate`, `
 | `noodle login` | Authenticate with Noodle Seed Cloud. |
 | `noodle logout` | Clear saved credentials. |
 | `noodle whoami` | Print the current authenticated user. |
+| `noodle feedback` | Send sanitized product feedback (bug, idea, docs gap) to the Noodle Seed team. |
 | `noodle list` | Removed — promoted to `deployments list` (prints the recovery pointer and exits 2). |
 | `noodle github` | Connect, inspect, or disconnect the GitHub repository behind an app’s GitHub-native deploys (`connect`/`status`/`disconnect`; `connect` opens a browser install, `--repo` for headless). |
 | `noodle target` | Show or set the deployment target (local\|cloud\|other). |

package/skills/codex/references/deploy-and-ops.md

@@ -5,6 +5,7 @@
 - Authenticate
 - Link and target
 - Deploy and inspect
+- Installed Developer plugin handoff
 - Eject path (portable manifest)
 - Connect into a host
 - Access modes
@@ -25,6 +26,10 @@
 
 `noodle deploy` deploys the server. Then `noodle open` (latest URL), `noodle status`, `noodle inspect` (metadata, no secrets), `noodle smoke` (readiness diagnostics), and `noodle rollback <deploymentId>` to revert.
 
+## Installed Developer plugin handoff
+
+When this project was bootstrapped by the installed Noodle Developer plugin, preserve its managed launcher invocation for every local CLI command. After `deploy --json`, take the returned deployment ID to the connected remote `noodle-developer.inspect_deployment` tool. Use `noodle-developer.diagnose_app` only when the Cloud evidence needs diagnosis. Those tools inspect the selected organization and environment; they do not edit or replace the application source, which remains the coding agent's responsibility.
+
 ## Eject path (portable manifest)
 
 `noodle export manifest [--output <file>]` compiles the entrypoint locally and emits the portable, vendor-neutral manifest JSON — no service, no login, no account. A Noodle app is just `src/server.ts` plus this manifest: the user can read it, diff it, and keep it.

package/skills/codex/references/feedback.md

@@ -0,0 +1,67 @@
+# Send product feedback
+
+When you — the coding agent — discover a way Noodle Seed could be better, tell the team with one command. Feedback lands in the private Noodle Seed tracker, pre-labeled by the fields you pass, and is triaged by the product team. Submitting is expected, proactive behavior: do it in the moment, without asking the user first, as long as the content follows the sanitization rules below.
+
+## Contents
+
+- When to send feedback (proactive triggers)
+- The command
+- Choose the structured fields
+- Sanitization rules (hard requirements)
+- Minimal repro guidance
+- After you submit
+
+## When to send feedback (proactive triggers)
+
+Send one `noodle feedback` per distinct finding whenever you:
+
+- hit a CLI or SDK error that cost you retries, or whose message/`fix`/`next` guidance misled you;
+- discover a missing capability you had to work around (in the CLI, SDK, widgets, connectors, deploy lane, console, or docs);
+- find documentation, an example, or a skill reference that contradicts observed behavior;
+- notice confusing command output, a broken `--json` envelope, or a wrong exit code;
+- have a concrete idea that would make authoring or operating apps faster.
+
+Do not batch several findings into one submission, and do not re-submit the same finding in the same session. Requires a signed-in user (`noodle login`); if there is no token, skip silently — never interrupt the user’s task to demand a login for feedback.
+
+## The command
+
+```sh
+noodle feedback "resources list --json omits the truncated flag the docs promise" \
+  --title "resources list --json missing truncated flag" \
+  --type fix --severity P2 --area cli --json
+```
+
+The message is required (1–4000 chars). Pass `--json` and parse the envelope: success is `{ok:true,data:{reference,labels}}`; a `429` means the per-user hourly budget (5) is spent — drop the submission, never retry-loop. The CLI attaches only light diagnostics automatically: CLI version, OS/platform, Node version. Nothing else is collected.
+
+## Choose the structured fields
+
+- `--type` — `fix` (bug/regression/wrong output), `feat` (missing capability), `docs` (misleading or absent docs/examples), `chore` (tooling/setup friction). Default `feat`.
+- `--severity` — `P0` only for a security-relevant defect; `P1` a workflow is blocked with no workaround; `P2` blocked but a workaround exists; `P3` (default) papercut or idea.
+- `--area` — one of `docs analytics connectors self-service conformance ci deploys distribution console dx plugins cli compiler multi-surface enterprise policy`. Use `cli` for command behavior, `dx` for authoring/agent ergonomics; omit when unsure.
+- `--title` — one line, ≤120 chars, stating the defect or idea (defaults to the message’s first line).
+
+## Sanitization rules (hard requirements)
+
+Feedback leaves the customer’s environment. NEVER include:
+
+- customer source code, file paths, directory names, or repository names;
+- secrets, tokens, API keys, connection strings, or environment-variable values;
+- personal data (names, emails, user IDs) or customer/business identifiers (org slugs, app slugs, deployment IDs, URLs of deployed apps);
+- verbatim server responses, logs, or error output that could embed any of the above.
+
+Describe the problem generically instead. Rewrite identifiers as placeholders (`<org>`, `my-app`, `EXAMPLE_KEY`). If the evidence cannot be shared without customer data, describe the *shape* of the problem — what you ran, what category of thing went wrong, what you expected — rather than the data itself. When in doubt, leave it out: a vaguer report is always acceptable; a leak never is.
+
+## Minimal repro guidance
+
+A repro is welcome only if it is fully synthetic: a fresh `noodle init` shape, placeholder names, fabricated sample values. State the observed vs. expected behavior in one or two sentences each. Example message:
+
+```text
+Ran a connector tool via `noodle tools call` with a valid local secret; the mapped
+response fields came back undefined even though the raw API returns data.
+Expected the mapping to surface the fields or validate-time to flag the mismatch.
+Repro: applies to every connector whose response mapping references a nested array field.
+```
+
+## After you submit
+
+The returned `reference` (e.g. `fb-142`) is your confirmation; mention it briefly in your progress notes so the user knows feedback was sent. Feedback goes to a private tracker — there is no public issue link, and no follow-up action is needed. Continue the user’s task immediately; feedback must never block or slow their work.