@noodleseed/agent-kit 0.79.1 → 0.80.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/agent-kit",
-  "version": "0.79.1",
+  "version": "0.80.0",
   "private": false,
   "description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
   "license": "Apache-2.0",

package/skills/claude-code/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:13ddce01769caae4 -->
+<!-- noodle-skill version:0.80.0 hash:13ddce01769caae4 -->
 
 # Noodle Seed
 

package/skills/claude-code/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:11523cb33b9473c0 -->
+<!-- noodle-skill version:0.80.0 hash:11523cb33b9473c0 -->
 
 # authoring-mcp-servers
 

package/skills/claude-code/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:9fd67d4d24328e15 -->
+<!-- noodle-skill version:0.80.0 hash:9fd67d4d24328e15 -->
 
 # building-mcp-apps
 

package/skills/claude-code/connecting-apis-to-mcp/SKILL.md

@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
 description: "Use when all four API-evidence inputs exist—and only then: API base URL, authentication scheme, representative safe read, and observed response."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:21bbd3ec441ffd30 -->
+<!-- noodle-skill version:0.80.0 hash:21bbd3ec441ffd30 -->
 
 # connecting-apis-to-mcp
 

package/skills/claude-code/creating-product-agent-guides/SKILL.md

@@ -3,7 +3,7 @@ name: creating-product-agent-guides
 description: "Use when a Noodle Seed MCP server needs a new or revised product agent guide, App Package skill, or explicit product-skill regeneration."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:0fa48a82fe836cf0 -->
+<!-- noodle-skill version:0.80.0 hash:0fa48a82fe836cf0 -->
 
 # creating-product-agent-guides
 

package/skills/claude-code/debugging-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
 description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:aa715bae12041d7c -->
+<!-- noodle-skill version:0.80.0 hash:aa715bae12041d7c -->
 
 # debugging-mcp-delivery
 

package/skills/claude-code/deploying-mcp-services/SKILL.md

@@ -3,7 +3,7 @@ name: deploying-mcp-services
 description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:93e735b7ffb45df1 -->
+<!-- noodle-skill version:0.80.0 hash:93e735b7ffb45df1 -->
 
 # deploying-mcp-services
 

package/skills/claude-code/designing-mcp-products/SKILL.md

@@ -3,7 +3,7 @@ name: designing-mcp-products
 description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:78a6f181b61f92f1 -->
+<!-- noodle-skill version:0.80.0 hash:78a6f181b61f92f1 -->
 
 # designing-mcp-products
 

package/skills/claude-code/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:cc54a67f21c0ecdb -->
+<!-- noodle-skill version:0.80.0 hash:cc54a67f21c0ecdb -->
 
 # embedding-mcp-assistants
 

package/skills/claude-code/examples/customer-auth/README.md

@@ -364,6 +364,7 @@ and passes `routing: { endpoints: { customer_api: cluster.apiBaseUrl } }` to
 browser. Do not copy the route into page context, session claims, tool input, or model instructions.
 
 ```bash
+noodle variables set ASSISTANT_ORIGIN https://app.example.com --scope env
 noodle variables set ASSISTANT_MODEL_BASE_URL https://model.example.com/v1 --scope env
 noodle variables set ASSISTANT_MODEL your-model --scope env
 noodle secrets set ASSISTANT_MODEL_API_KEY --scope env
@@ -372,7 +373,8 @@ noodle secrets set CUSTOMER_API_CLIENT_SECRET --scope env
 noodle check --target embedded-assistant src/server.ts
 ```
 
-Assistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for
+`ASSISTANT_ORIGIN` is the operator-owned production embedding origin, so one source can serve every customer
+without an application fork. Assistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for
 loopback development origins such as `http://localhost:3000`, `http://127.0.0.1:3000`, or
 `http://[::1]:3000`. `noodle dev` serves the MCP project, not that separate embedding application.
 

package/skills/claude-code/examples/customer-auth/src/server.ts

@@ -16,6 +16,7 @@ import {
 const customerApi = customerEndpoint('customer_api', {
   allowedHttpsHostSuffixes: ['api.noodleseed.dev'],
 });
+const assistantOrigin = variable('ASSISTANT_ORIGIN');
 
 const noodleseedApi = connector('noodleseed_app_api')
   .version('1.0.0')
@@ -170,11 +171,7 @@ export default server(
       }),
       // Production origins are exact HTTPS; http://localhost:<port> is allowed for local development.
       access: authenticatedWebsite({
-        origins: [
-          'https://app.noodleseed.com',
-          'https://dev.noodleseed.com',
-          'http://localhost:3000',
-        ],
+        origins: [assistantOrigin, 'https://dev.noodleseed.com', 'http://localhost:3000'],
       }),
       layout: { mode: 'floating', position: 'bottom-right', panelWidth: 420 },
       labels: {

package/skills/claude-code/examples/customer-auth/test/server.test.ts

@@ -14,11 +14,11 @@ describe('customer-auth example', () => {
         header: { mark: 'status', badge: { text: 'Workspace online', tone: 'success' } },
       },
     });
-    expect(
-      manifest.server.assistant?.allowedOrigins.every(
-        (origin) => origin.startsWith('https://') || origin.startsWith('http://localhost:'),
-      ),
-    ).toBe(true);
+    expect(manifest.server.assistant?.allowedOrigins).toEqual([
+      '${env.ASSISTANT_ORIGIN}',
+      'https://dev.noodleseed.com',
+      'http://localhost:3000',
+    ]);
     expect(manifest.server.branding).toMatchObject({
       name: 'Noodle Seed Assistant',
       colorScheme: 'auto',

package/skills/claude-code/executing-noodle-plans/SKILL.md

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.80.0 hash:6a9f132ddb79352e -->
 
 # Execute a Noodle Seed implementation plan
 

package/skills/claude-code/publishing-mcp-integrations/SKILL.md

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:efffbf82007f935d -->
+<!-- noodle-skill version:0.80.0 hash:efffbf82007f935d -->
 
 # publishing-mcp-integrations
 

package/skills/claude-code/references/authoring-workflow.md

@@ -105,7 +105,7 @@ export default server('support', { title: 'Support', version: '1.0.0', use: { cr
 ]);
 ```
 
-Naming: connector operation names and tool names are lowercase-with-underscores. Map with `${args.field}` for tool/operation inputs and `${response.path}` for the response — the parsed JSON body is bound directly to `${response}`, so there is **no `.body` envelope**; use bracket syntax for array indices (`${response.data[0].id}`) — a dotted numeric index like `.0.` is invalid. Declare URL query parameters with the operation-level `query: ["arg"]` array, **not** inside `request` (which builds only the JSON body). `allowedOrigins` must be literal origin URLs (the SSRF allowlist); `baseUrl` may be a `variable(...)` that differs by env.
+Naming: connector operation names and tool names are lowercase-with-underscores. Map with `${args.field}` for tool/operation inputs and `${response.path}` for the response — the parsed JSON body is bound directly to `${response}`, so there is **no `.body` envelope**; use bracket syntax for array indices (`${response.data[0].id}`) — a dotted numeric index like `.0.` is invalid. Declare URL query parameters with the operation-level `query: ["arg"]` array, **not** inside `request` (which builds only the JSON body). `allowedOrigins` is the SSRF allowlist: use literal exact origins, or the same `variable("STORE_ORIGIN")` as `baseUrl` when one reusable single-origin app is bound per business. A managed origin must resolve to one canonical bare HTTPS origin (exact loopback HTTP is the development exception); never use a wildcard, path, or tenant source edit.
 
 More: `auth.kind` is `bearer` | `apiKey` (needs `header`) | `clientCredentials` | `delegatedOAuth` | `delegatedSessionCookie` | `delegatedTokenExchange`. For client credentials use `{ kind: "clientCredentials", tokenUrl, clientId, clientSecret, scopes? }` (RFC-6749 grant); for a non-standard partner token endpoint add `profile: "custom"` with a `custom: { requestFormat, clientIdField, clientSecretField, tokenResponsePath, expirySource }` descriptor. Do not put credential headers in operation `headers`; use connector `auth`. Use `.compute(name, { input, output, run })` for a sandboxed transform; `provides:` (instead of `use:`) exposes a connector only to compute `callOperation`; and `noodle import openapi <file>` generates a connector from an OpenAPI spec.
 

package/skills/claude-code/reporting-noodle-feedback/SKILL.md

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:0f404109f4845683 -->
+<!-- noodle-skill version:0.80.0 hash:0f404109f4845683 -->
 
 # reporting-noodle-feedback
 

package/skills/claude-code/verifying-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:6ef6ef551e26b78e -->
+<!-- noodle-skill version:0.80.0 hash:6ef6ef551e26b78e -->
 
 # verifying-mcp-delivery
 

package/skills/claude-code/wrapping-existing-applications/SKILL.md

@@ -3,7 +3,7 @@ name: wrapping-existing-applications
 description: "Use when an existing application has no stable usable API and needs a read-only, identity-first Noodle Seed integration plan before implementation."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:eccc3c158dcafba8 -->
+<!-- noodle-skill version:0.80.0 hash:eccc3c158dcafba8 -->
 
 # wrapping-existing-applications
 

package/skills/codex/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:13ddce01769caae4 -->
+<!-- noodle-skill version:0.80.0 hash:13ddce01769caae4 -->
 
 # Noodle Seed
 

package/skills/codex/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:11523cb33b9473c0 -->
+<!-- noodle-skill version:0.80.0 hash:11523cb33b9473c0 -->
 
 # authoring-mcp-servers
 

package/skills/codex/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:9fd67d4d24328e15 -->
+<!-- noodle-skill version:0.80.0 hash:9fd67d4d24328e15 -->
 
 # building-mcp-apps
 

package/skills/codex/connecting-apis-to-mcp/SKILL.md

@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
 description: "Use when all four API-evidence inputs exist—and only then: API base URL, authentication scheme, representative safe read, and observed response."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:21bbd3ec441ffd30 -->
+<!-- noodle-skill version:0.80.0 hash:21bbd3ec441ffd30 -->
 
 # connecting-apis-to-mcp
 

package/skills/codex/creating-product-agent-guides/SKILL.md

@@ -3,7 +3,7 @@ name: creating-product-agent-guides
 description: "Use when a Noodle Seed MCP server needs a new or revised product agent guide, App Package skill, or explicit product-skill regeneration."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:0fa48a82fe836cf0 -->
+<!-- noodle-skill version:0.80.0 hash:0fa48a82fe836cf0 -->
 
 # creating-product-agent-guides
 

package/skills/codex/debugging-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
 description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:aa715bae12041d7c -->
+<!-- noodle-skill version:0.80.0 hash:aa715bae12041d7c -->
 
 # debugging-mcp-delivery
 

package/skills/codex/deploying-mcp-services/SKILL.md

@@ -3,7 +3,7 @@ name: deploying-mcp-services
 description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:93e735b7ffb45df1 -->
+<!-- noodle-skill version:0.80.0 hash:93e735b7ffb45df1 -->
 
 # deploying-mcp-services
 

package/skills/codex/designing-mcp-products/SKILL.md

@@ -3,7 +3,7 @@ name: designing-mcp-products
 description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:78a6f181b61f92f1 -->
+<!-- noodle-skill version:0.80.0 hash:78a6f181b61f92f1 -->
 
 # designing-mcp-products
 

package/skills/codex/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:cc54a67f21c0ecdb -->
+<!-- noodle-skill version:0.80.0 hash:cc54a67f21c0ecdb -->
 
 # embedding-mcp-assistants
 

package/skills/codex/examples/customer-auth/README.md

@@ -364,6 +364,7 @@ and passes `routing: { endpoints: { customer_api: cluster.apiBaseUrl } }` to
 browser. Do not copy the route into page context, session claims, tool input, or model instructions.
 
 ```bash
+noodle variables set ASSISTANT_ORIGIN https://app.example.com --scope env
 noodle variables set ASSISTANT_MODEL_BASE_URL https://model.example.com/v1 --scope env
 noodle variables set ASSISTANT_MODEL your-model --scope env
 noodle secrets set ASSISTANT_MODEL_API_KEY --scope env
@@ -372,7 +373,8 @@ noodle secrets set CUSTOMER_API_CLIENT_SECRET --scope env
 noodle check --target embedded-assistant src/server.ts
 ```
 
-Assistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for
+`ASSISTANT_ORIGIN` is the operator-owned production embedding origin, so one source can serve every customer
+without an application fork. Assistant origins are exact. Production embedding origins must use HTTPS; plain HTTP is accepted only for
 loopback development origins such as `http://localhost:3000`, `http://127.0.0.1:3000`, or
 `http://[::1]:3000`. `noodle dev` serves the MCP project, not that separate embedding application.
 

package/skills/codex/examples/customer-auth/src/server.ts

@@ -16,6 +16,7 @@ import {
 const customerApi = customerEndpoint('customer_api', {
   allowedHttpsHostSuffixes: ['api.noodleseed.dev'],
 });
+const assistantOrigin = variable('ASSISTANT_ORIGIN');
 
 const noodleseedApi = connector('noodleseed_app_api')
   .version('1.0.0')
@@ -170,11 +171,7 @@ export default server(
       }),
       // Production origins are exact HTTPS; http://localhost:<port> is allowed for local development.
       access: authenticatedWebsite({
-        origins: [
-          'https://app.noodleseed.com',
-          'https://dev.noodleseed.com',
-          'http://localhost:3000',
-        ],
+        origins: [assistantOrigin, 'https://dev.noodleseed.com', 'http://localhost:3000'],
       }),
       layout: { mode: 'floating', position: 'bottom-right', panelWidth: 420 },
       labels: {

package/skills/codex/examples/customer-auth/test/server.test.ts

@@ -14,11 +14,11 @@ describe('customer-auth example', () => {
         header: { mark: 'status', badge: { text: 'Workspace online', tone: 'success' } },
       },
     });
-    expect(
-      manifest.server.assistant?.allowedOrigins.every(
-        (origin) => origin.startsWith('https://') || origin.startsWith('http://localhost:'),
-      ),
-    ).toBe(true);
+    expect(manifest.server.assistant?.allowedOrigins).toEqual([
+      '${env.ASSISTANT_ORIGIN}',
+      'https://dev.noodleseed.com',
+      'http://localhost:3000',
+    ]);
     expect(manifest.server.branding).toMatchObject({
       name: 'Noodle Seed Assistant',
       colorScheme: 'auto',

package/skills/codex/executing-noodle-plans/SKILL.md

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.80.0 hash:6a9f132ddb79352e -->
 
 # Execute a Noodle Seed implementation plan
 

package/skills/codex/publishing-mcp-integrations/SKILL.md

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:efffbf82007f935d -->
+<!-- noodle-skill version:0.80.0 hash:efffbf82007f935d -->
 
 # publishing-mcp-integrations
 

package/skills/codex/references/authoring-workflow.md

@@ -105,7 +105,7 @@ export default server('support', { title: 'Support', version: '1.0.0', use: { cr
 ]);
 ```
 
-Naming: connector operation names and tool names are lowercase-with-underscores. Map with `${args.field}` for tool/operation inputs and `${response.path}` for the response — the parsed JSON body is bound directly to `${response}`, so there is **no `.body` envelope**; use bracket syntax for array indices (`${response.data[0].id}`) — a dotted numeric index like `.0.` is invalid. Declare URL query parameters with the operation-level `query: ["arg"]` array, **not** inside `request` (which builds only the JSON body). `allowedOrigins` must be literal origin URLs (the SSRF allowlist); `baseUrl` may be a `variable(...)` that differs by env.
+Naming: connector operation names and tool names are lowercase-with-underscores. Map with `${args.field}` for tool/operation inputs and `${response.path}` for the response — the parsed JSON body is bound directly to `${response}`, so there is **no `.body` envelope**; use bracket syntax for array indices (`${response.data[0].id}`) — a dotted numeric index like `.0.` is invalid. Declare URL query parameters with the operation-level `query: ["arg"]` array, **not** inside `request` (which builds only the JSON body). `allowedOrigins` is the SSRF allowlist: use literal exact origins, or the same `variable("STORE_ORIGIN")` as `baseUrl` when one reusable single-origin app is bound per business. A managed origin must resolve to one canonical bare HTTPS origin (exact loopback HTTP is the development exception); never use a wildcard, path, or tenant source edit.
 
 More: `auth.kind` is `bearer` | `apiKey` (needs `header`) | `clientCredentials` | `delegatedOAuth` | `delegatedSessionCookie` | `delegatedTokenExchange`. For client credentials use `{ kind: "clientCredentials", tokenUrl, clientId, clientSecret, scopes? }` (RFC-6749 grant); for a non-standard partner token endpoint add `profile: "custom"` with a `custom: { requestFormat, clientIdField, clientSecretField, tokenResponsePath, expirySource }` descriptor. Do not put credential headers in operation `headers`; use connector `auth`. Use `.compute(name, { input, output, run })` for a sandboxed transform; `provides:` (instead of `use:`) exposes a connector only to compute `callOperation`; and `noodle import openapi <file>` generates a connector from an OpenAPI spec.
 

package/skills/codex/reporting-noodle-feedback/SKILL.md

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:0f404109f4845683 -->
+<!-- noodle-skill version:0.80.0 hash:0f404109f4845683 -->
 
 # reporting-noodle-feedback
 

package/skills/codex/verifying-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:6ef6ef551e26b78e -->
+<!-- noodle-skill version:0.80.0 hash:6ef6ef551e26b78e -->
 
 # verifying-mcp-delivery
 

package/skills/codex/wrapping-existing-applications/SKILL.md

@@ -3,7 +3,7 @@ name: wrapping-existing-applications
 description: "Use when an existing application has no stable usable API and needs a read-only, identity-first Noodle Seed integration plan before implementation."
 ---
 
-<!-- noodle-skill version:0.79.1 hash:eccc3c158dcafba8 -->
+<!-- noodle-skill version:0.80.0 hash:eccc3c158dcafba8 -->
 
 # wrapping-existing-applications