@noodleseed/agent-kit 0.7.0 → 0.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/manifest.json
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
{
|
|
2
|
-
"packageVersion": "0.
|
|
2
|
+
"packageVersion": "0.8.1",
|
|
3
3
|
"files": [
|
|
4
4
|
{
|
|
5
5
|
"path": "skills/codex/SKILL.md",
|
|
6
|
-
"sha256": "
|
|
6
|
+
"sha256": "f95d48599e316191d1ddc6c2091eab4bc6528c0fef7055a79844a1645d966386",
|
|
7
7
|
"agentTarget": "codex"
|
|
8
8
|
},
|
|
9
9
|
{
|
|
@@ -28,7 +28,7 @@
|
|
|
28
28
|
},
|
|
29
29
|
{
|
|
30
30
|
"path": "skills/codex/references/widgets-and-apps.md",
|
|
31
|
-
"sha256": "
|
|
31
|
+
"sha256": "ddff34458ad8f5e57db9f8501d0f2381098ec999fd9fcab031881e5c1c978110",
|
|
32
32
|
"agentTarget": "codex"
|
|
33
33
|
},
|
|
34
34
|
{
|
|
@@ -43,7 +43,7 @@
|
|
|
43
43
|
},
|
|
44
44
|
{
|
|
45
45
|
"path": "skills/claude-code/SKILL.md",
|
|
46
|
-
"sha256": "
|
|
46
|
+
"sha256": "1812332d59779f157893ed5329db7760f0f68baec52fbe900a09c45691689b9d",
|
|
47
47
|
"agentTarget": "claude-code"
|
|
48
48
|
},
|
|
49
49
|
{
|
|
@@ -68,7 +68,7 @@
|
|
|
68
68
|
},
|
|
69
69
|
{
|
|
70
70
|
"path": "skills/claude-code/references/widgets-and-apps.md",
|
|
71
|
-
"sha256": "
|
|
71
|
+
"sha256": "ddff34458ad8f5e57db9f8501d0f2381098ec999fd9fcab031881e5c1c978110",
|
|
72
72
|
"agentTarget": "claude-code"
|
|
73
73
|
},
|
|
74
74
|
{
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@noodleseed/agent-kit",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.8.1",
|
|
4
4
|
"private": false,
|
|
5
5
|
"description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -23,10 +23,12 @@ const { useCallTool, useLayout, useToolInfo, useViewState } = generateHelpers<Ap
|
|
|
23
23
|
|
|
24
24
|
Bind interactive elements to tools (`useCallTool("place_order")`) and annotate model-facing context with `data-llm`. A raw `html` escape hatch exists for self-contained widgets (declarative `data-bind`/`data-action`; no inline `<script>`).
|
|
25
25
|
|
|
26
|
-
## CSP and permissions
|
|
26
|
+
## CSP, domain, and permissions
|
|
27
27
|
|
|
28
28
|
Declare network/host needs explicitly: `csp: { connectDomains, resourceDomains, frameDomains }` and `permissions` (e.g. `clipboardWrite`). Secrets are never injected into widgets; tool output is redacted before widget delivery.
|
|
29
29
|
|
|
30
|
+
For ChatGPT: set `domain` on each widget (one https origin per app; required for app-store submission, optional for dev-mode testing), and declare external-link targets in the server-level `handoff.allowedDomains` — the compiler derives ChatGPT’s `redirect_domains` from it so `useOpenExternal()` links open without the safe-link warning. `noodle check --target chatgpt` verifies all of this.
|
|
31
|
+
|
|
30
32
|
## Host bridge
|
|
31
33
|
|
|
32
34
|
One runtime targets both Claude’s ext-apps bridge and ChatGPT’s `window.openai`, detected at startup. Tool results still carry useful `content`/`structuredContent` so non-Apps hosts degrade gracefully.
|
package/skills/codex/SKILL.md
CHANGED
|
@@ -23,10 +23,12 @@ const { useCallTool, useLayout, useToolInfo, useViewState } = generateHelpers<Ap
|
|
|
23
23
|
|
|
24
24
|
Bind interactive elements to tools (`useCallTool("place_order")`) and annotate model-facing context with `data-llm`. A raw `html` escape hatch exists for self-contained widgets (declarative `data-bind`/`data-action`; no inline `<script>`).
|
|
25
25
|
|
|
26
|
-
## CSP and permissions
|
|
26
|
+
## CSP, domain, and permissions
|
|
27
27
|
|
|
28
28
|
Declare network/host needs explicitly: `csp: { connectDomains, resourceDomains, frameDomains }` and `permissions` (e.g. `clipboardWrite`). Secrets are never injected into widgets; tool output is redacted before widget delivery.
|
|
29
29
|
|
|
30
|
+
For ChatGPT: set `domain` on each widget (one https origin per app; required for app-store submission, optional for dev-mode testing), and declare external-link targets in the server-level `handoff.allowedDomains` — the compiler derives ChatGPT’s `redirect_domains` from it so `useOpenExternal()` links open without the safe-link warning. `noodle check --target chatgpt` verifies all of this.
|
|
31
|
+
|
|
30
32
|
## Host bridge
|
|
31
33
|
|
|
32
34
|
One runtime targets both Claude’s ext-apps bridge and ChatGPT’s `window.openai`, detected at startup. Tool results still carry useful `content`/`structuredContent` so non-Apps hosts degrade gracefully.
|