@noodleseed/agent-kit 0.81.0 → 0.83.0

package/skills/codex/examples/customer-auth/README.md

@@ -541,9 +541,15 @@ then aborts and clears the prior session and transcript. The sample fails closed
 fallback is replaced with a form generated from `requestedSchema`. A production renderer must show the
 complete confirmation review and both decisions. For `data-view`, map `resourceUri` or `tool` and the
 bounded/redacted result to a component already trusted by this application only when intentionally replacing
-the linked App with a native UI. Otherwise use `NoodleAppView`; JSON result data is not the App UI. Its
-semantic lifecycle identity is the client plus `view.id` plus `view.resourceUri`, so parent payload/callback
-rerenders keep the iframe and only a different view or unmount tears down the bridge.
+the linked App with a native UI. Otherwise use `<noodle-app-view>` or its React `NoodleAppView` adapter;
+JSON result data is not the App UI. The element's semantic lifecycle identity is the client plus `view.id`
+plus `view.resourceUri`, so parent payload/callback rerenders keep the iframe and only a different view,
+disconnect, or App teardown request retires the bridge.
+App views remain inline by default: the host advertises only inline presentation and rejects a widget's
+fullscreen request. A customer-owned renderer may opt in explicitly with `allowFullscreen` on
+`NoodleAppView` or `allow-fullscreen` on `<noodle-app-view>` only when fullscreen is part of its intended
+experience. When fullscreen is accepted, the shared host adds a top-right exit control that returns the same
+mounted App to inline mode without discarding its state.
 Never inject `part.data.html`, assign it to `srcdoc`, fetch a `ui://` URI, or reproduce the bridge directly. Pages with a
 Content-Security-Policy must include the Noodle service origin in both `connect-src` and `frame-src`.
 
@@ -588,23 +594,33 @@ useEffect(() => {
 
 For a chat-first custom host, raw `tool_started` supplies the direct call `id` and technical tool name. Map
 known tools to concise application copy and use a neutral fallback. Reserve a stable `role="status"` region
-for thinking, tool activity, and the view skeleton; switch to the ready `NoodleAppView` on `view_available`
-or to `role="alert"` on error. Decorative skeleton shapes stay hidden from assistive technology, and shimmer
+for thinking, tool activity, and the view skeleton; switch to the ready `<noodle-app-view>` (or React
+`NoodleAppView`) on `view_available` or to `role="alert"` on error. Decorative skeleton shapes stay hidden from assistive technology, and shimmer
 or transition motion is disabled under `prefers-reduced-motion`.
 
 Use `${view.id}:${view.resourceUri}` as transport identity. Different call IDs are distinct invocations and
 must not be deduplicated generically. If this application intentionally owns one current panel for a known
 resource, declare an application-owned slot for that resource and replace only that slot.
 
-Outside React, subscribe to the DOM-free client directly. It exposes the same conversation as headless AI
-SDK `UIMessage` state, including typed confirmation, input, tool-result, and linked-view parts:
+Outside React, subscribe to the DOM-free client directly and use the isolated framework-neutral App host.
+It exposes the same conversation as headless AI SDK `UIMessage` state, including typed confirmation, input,
+tool-result, and linked-view parts, without installing React:
+
+```html
+<noodle-app-view id="assistant-app-view"></noodle-app-view>
+```
 
 ```ts
+import '@noodleseed/assistant/app-view';
 import { createAssistantClient } from '@noodleseed/assistant/client';
 
 const assistant = createAssistantClient({
   sessionEndpoint: '/api/noodle-assistant/session',
 });
+const appView = document.querySelector('#assistant-app-view');
+if (!appView) throw new Error('Missing App view host');
+appView.client = assistant;
+appView.theme = resolvedTheme;
 
 assistant.subscribeChat((state) => {
   renderUIMessageState(state);
@@ -613,13 +629,14 @@ assistant.subscribeChat((state) => {
       if (part.type === 'data-confirmation' && part.data.status === 'pending') {
         renderConfirmation(part.data, (response) => assistant.respond(part.data.id, response));
       }
+      if (part.type === 'data-view') appView.view = part.data;
     }
   }
 });
 ```
 
 `theme="auto"` follows the operating-system preference, not a SaaS-owned toggle. Pass the resolved
-`light`/`dark` theme to `NoodleAssistant` and `NoodleAppView`; updates reach mounted MCP Apps without a
+`light`/`dark` theme to `NoodleAssistant` and `<noodle-app-view>`/`NoodleAppView`; updates reach mounted MCP Apps without a
 remount. CSS custom properties inherit through the host, and documented `--ns-assistant-*` variables remain
 the final integration escape hatch. Server `branding` is shared by widgets and the assistant; there is no
 second branding declaration. Text streams progressively. Expired turns re-exchange and retry once;

package/skills/codex/executing-noodle-plans/SKILL.md

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
 
-<!-- noodle-skill version:0.81.0 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.83.0 hash:6a9f132ddb79352e -->
 
 # Execute a Noodle Seed implementation plan
 

package/skills/codex/publishing-mcp-integrations/SKILL.md

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
 
-<!-- noodle-skill version:0.81.0 hash:efffbf82007f935d -->
+<!-- noodle-skill version:0.83.0 hash:efffbf82007f935d -->
 
 # publishing-mcp-integrations
 

package/skills/codex/references/embedded-assistant.md

@@ -29,7 +29,8 @@ Keep every credential and identity layer separate:
 | Owner | Values | Destination |
 | --- | --- | --- |
 | Noodle operator | Login, selected org/app/env | Plugin-managed CLI profile and explicit target; never the SaaS runtime |
-| Noodle deployment | `ASSISTANT_MODEL_BASE_URL`, `ASSISTANT_MODEL`, `ASSISTANT_MODEL_API_KEY` | `noodle variables set` / `noodle secrets set`; never the SaaS environment |
+| Noodle-managed model | No authored provider, model id, URL, or key | Hosted operator state; available only when Noodle has enrolled the exact org/app/env |
+| Operator-provided model | `ASSISTANT_MODEL_BASE_URL`, `ASSISTANT_MODEL`, `ASSISTANT_MODEL_API_KEY` | `noodle variables set` / `noodle secrets set`; never the SaaS environment |
 | Connector/delegated exchange | Connector credentials and any customer-owned token-exchange client | Noodle managed configuration plus the matching customer backend secret manager |
 | SaaS backend | `NOODLE_SERVICE_URL`, `NOODLE_ASSISTANT_CLIENT_ID`, `NOODLE_ASSISTANT_CLIENT_SECRET`, `PUBLIC_APP_ORIGIN` | Backend-only environment or secret manager; never browser code or public-prefixed variables |
 | Browser | Short-lived assistant session only | In memory; never a client secret, model key, connector credential, or raw application session |
@@ -48,11 +49,7 @@ Use the same server tools in the embed; do not create a second tool set. Declare
 branding: { name: "Acme", accent: "#3157D5" },
 context: { defaults: { locale: "en-GB", timeZone: "Europe/London" } },
 assistant: embeddedAssistant({
-  model: openAICompatible({
-    baseUrl: variable("ASSISTANT_MODEL_BASE_URL"),
-    model: variable("ASSISTANT_MODEL"),
-    apiKey: secret("ASSISTANT_MODEL_API_KEY"),
-  }),
+  model: noodleManaged(),
   access: authenticatedWebsite({
     origins: ["http://localhost:3000", "https://app.example.com"],
   }),
@@ -60,6 +57,8 @@ assistant: embeddedAssistant({
 }),
 ```
 
+`noodleManaged()` is the zero-configuration Cloud path: the public artifact contains only `{ kind: "noodle-managed" }`. It never exposes a provider or model identifier, and it fails closed unless Noodle has enrolled that exact deployment target. For a customer- or self-hosted model, replace it with `openAICompatible({ baseUrl: variable("ASSISTANT_MODEL_BASE_URL"), model: variable("ASSISTANT_MODEL"), apiKey: secret("ASSISTANT_MODEL_API_KEY") })`; that remains the portable BYO path.
+
 Origins are exact: scheme, host, and optional port, with no path, trailing slash, or wildcard. Production origins must be HTTPS; plain HTTP is accepted only for loopback development origins (`http://localhost:<port>`, `http://127.0.0.1:<port>`). `noodle dev` serves the MCP project, not the embedding SaaS. For a public surface it also prints a process-local Embed ID and script; mount that script on the separately running loopback website to test anonymous mint, chat, widgets, and confirmation. The local ID is ephemeral, while a hosted deploy provisions the stable ID behind durable admission counters.
 
 ## Product workflow guidance
@@ -166,7 +165,7 @@ Local MCP authoring and tests need no account, but an external browser embed nee
 noodle deploy --org <org> --app <app> --env <env>
 ```
 
-Deploy preflights the complete target before upload. In an interactive terminal it collects all missing model variables and secrets, then continues. In a non-interactive run it reports every missing name and safe `noodle variables set ... --from-env` / `noodle secrets set ... --from-env` action; perform every action and repeat the same deploy command. Values never appear in the preflight report or resume state. Do not put these model values in the embedding SaaS environment. A production deployment may omit a local origin; include a loopback origin only when local browser integration is required.
+Deploy preflights the complete target before upload. `noodleManaged()` has no customer model variables or secrets; enrollment is hosted operator state and an unenrolled target fails closed at serving time. `openAICompatible()` preflight collects or reports every missing model variable and secret with safe `noodle variables set ... --from-env` / `noodle secrets set ... --from-env` actions. Values never appear in the preflight report or resume state. Do not put BYO model values in the embedding SaaS environment. A production deployment may omit a local origin; include a loopback origin only when local browser integration is required.
 
 ## Access modes and customer auth
 
@@ -513,14 +512,19 @@ useEffect(() => {
 
 `settle` must await or catch the command promise; the same structured failure also appears in the hook `error` state.
 
-The sample fails closed on input requests until you replace that branch with a form generated from `requestedSchema`. A custom renderer must show the complete confirmation review and both decisions, handle every part it supports, and surface an explicit unsupported state for the rest. For `data-view`, use `NoodleAppView` to render the linked App or deliberately map `resourceUri`/tool plus the bounded redacted `result` to an application-trusted native component. JSON result data is not the linked App UI. Never inject `part.data.html`, assign it to `srcdoc`, fetch a `ui://` URI, or reproduce the bridge with a direct Ext Apps dependency. Do not wrap this client in another chat transport or invent user messages for interaction continuations.
+The sample fails closed on input requests until you replace that branch with a form generated from `requestedSchema`. A custom renderer must show the complete confirmation review and both decisions, handle every part it supports, and surface an explicit unsupported state for the rest. For `data-view`, use the canonical `<noodle-app-view>` host (or its React `NoodleAppView` adapter) to render the linked App, or deliberately map `resourceUri`/tool plus the bounded redacted `result` to an application-trusted native component. JSON result data is not the linked App UI. Never inject `part.data.html`, assign it to `srcdoc`, fetch a `ui://` URI, or reproduce the bridge with a direct Ext Apps dependency. Do not wrap this client in another chat transport or invent user messages for interaction continuations.
+
+`<noodle-app-view>` owns one bridge for the semantic view identity: client + `view.id` + `view.resourceUri`; `NoodleAppView` delegates to it. The host retains the iframe across fresh payload/callback/theme rerenders, publishes later resolved-theme changes through MCP Apps host context, and sends standard App teardown when that semantic identity changes, the element disconnects, or the App requests teardown. App views remain inline by default; the host advertises only inline presentation and rejects widget fullscreen requests. Opt in with `allowFullscreen` on `NoodleAppView` or `allow-fullscreen` on `<noodle-app-view>` only when fullscreen is an intentional part of the customer-owned experience. When fullscreen is accepted, the shared host adds an accessible top-right exit control that returns the same mounted App to inline mode without losing its state. Pass the same resolved application theme used by the conversation shell. Do not key an ancestor by a view object or callback. If the embedding page sets Content-Security-Policy, include the Noodle service origin in both `connect-src` and `frame-src`.
 
-`NoodleAppView` owns one bridge for the semantic view identity: client + `view.id` + `view.resourceUri`. It retains the iframe across fresh payload/callback/theme rerenders, reads current payloads through refs, publishes later resolved-theme changes through MCP Apps host context, and sends standard App teardown only when that semantic identity changes or the component unmounts. Pass the same resolved application theme used by the conversation shell. Do not key an ancestor by a view object or callback. If the embedding page sets Content-Security-Policy, include the Noodle service origin in both `connect-src` and `frame-src`.
+Outside React, use the same DOM-free client directly and import the isolated App-view entry only when rendering linked Apps. The client keeps the session token in memory, the transcript stays React-free, and the element owns only App presentation:
 
-Outside React, use the same DOM-free client directly. It keeps the session token in memory, exposes a React-free `UIMessage` transcript with typed parts, and never registers a custom element:
+```html
+<noodle-app-view id="assistant-app-view"></noodle-app-view>
+```
 
 ```ts
 import { createAssistantClient } from "@noodleseed/assistant/client";
+import "@noodleseed/assistant/app-view";
 
 const assistant = createAssistantClient({
   sessionEndpoint: "/api/assistant/session",
@@ -530,6 +534,11 @@ const assistant = createAssistantClient({
   }),
 });
 
+const appView = document.querySelector("#assistant-app-view");
+if (!appView) throw new Error("Missing App view host");
+appView.client = assistant;
+appView.theme = document.documentElement.classList.contains('dark') ? 'dark' : 'light';
+
 assistant.updateModelContext({
   content: [{ type: 'text', text: 'The time-off form is mounted.' }],
   structuredContent: { widget: { name: 'time-off', lifecycle: 'mounted' } },
@@ -548,7 +557,7 @@ assistant.subscribeChat((state) => {
         pending = { id: part.data.id, requestedSchema: part.data.requestedSchema };
       }
       if (part.type === 'data-view') {
-        renderRegisteredView(part.data.resourceUri, part.data.result);
+        appView.view = part.data;
       }
     }
   }
@@ -587,7 +596,7 @@ assistant.subscribe((event) => {
 });
 ```
 
-`data-view` means a completed tool has a linked MCP App view. In a customer-owned React renderer, pass that typed part and the existing client to `NoodleAppView`; it retains one bridge for client + `view.id` + `view.resourceUri` and requests standard App teardown on semantic replacement or unmount. That pair is transport identity: different call ids are distinct invocations and must not be deduplicated generically. If the product intentionally owns one current panel for a known resource, declare an application-owned slot map and replace only that slot. Deliberately map the bounded result to an application-trusted native component only when replacing the linked App UI.
+`data-view` means a completed tool has a linked MCP App view. Pass that typed part and the existing client to `<noodle-app-view>` in Vue, Angular, or plain DOM, or to its `NoodleAppView` React adapter. It retains one bridge for client + `view.id` + `view.resourceUri` and requests standard App teardown on semantic replacement, disconnect, or App request. That pair is transport identity: different call ids are distinct invocations and must not be deduplicated generically. If the product intentionally owns one current panel for a known resource, declare an application-owned slot map and replace only that slot. Deliberately map the bounded result to an application-trusted native component only when replacing the linked App UI.
 
 `clientContext` and typed `pageContext` are recomputed for each turn. `updateContext(...)` remains the legacy session-exchange context; `updatePageContext(...)` replaces the fresh per-turn application hint. `updateModelContext({ content, structuredContent })` publishes one cohesive renderer snapshot for later message turns without starting a turn; every call replaces the prior snapshot rather than merging fields. These are untrusted data, not conversation history or authorization input, and the boundaries reject credential-shaped or unbounded updates. A message may re-exchange once after a pre-execution `401`; the client never auto-retries interaction decisions. `tool_proposed.arguments` is a complete schema-aware review projection and, for connector-backed tools, names the sole exact connector version/operation/resolved arguments. Sensitive/write-only fields are redacted; truncating or omitting any non-sensitive action field fails closed. Accept is bound to the server-held action and claims at most one execution attempt—clients cannot replace it. Normal terminal outcomes scrub private arguments and continuations immediately; only an accepted action still executing retains them for the one-hour unknown-outcome recovery window, after which it records `interaction_outcome_unknown` and scrubs. Without downstream idempotency this is not an exactly-once business-effect guarantee. To reconcile a lost response, explicitly repeat the same id and decision: the service returns its durable stored outcome without re-execution.
 
@@ -612,7 +621,7 @@ Devtools privacy gate: default model and connector exercises to synthetic or moc
 
 - Node.js 20+ for `@noodleseed/assistant/server`.
 - The package ships ESM and CommonJS with full export conditions; no bundler aliases, `transpilePackages`, or ambient type shims are needed. If resolution fails, the installed package version is outdated: update `@noodleseed/assistant` instead of adding workarounds.
-- TypeScript `moduleResolution` `bundler` or `node16` recommended; classic `node` also resolves the `/client`, `/react`, `/react/client`, and `/server` subpaths.
+- TypeScript `moduleResolution` `bundler` or `node16` recommended; classic `node` also resolves the `/app-view`, `/client`, `/react`, `/react/client`, and `/server` subpaths.
 
 ## Verify the boundary
 

package/skills/codex/references/sdk-surface.md

@@ -65,6 +65,7 @@ Platform helper connectors are explicit subpath imports from `@noodleseed/one/pl
 - `knowledge`
 - `managedSecret`
 - `meilisearch`
+- `noodleManaged`
 - `openAICompatible`
 - `publicWebsite`
 - `site`

package/skills/codex/reporting-noodle-feedback/SKILL.md

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
 
-<!-- noodle-skill version:0.81.0 hash:0f404109f4845683 -->
+<!-- noodle-skill version:0.83.0 hash:0f404109f4845683 -->
 
 # reporting-noodle-feedback
 

package/skills/codex/verifying-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
 
-<!-- noodle-skill version:0.81.0 hash:6ef6ef551e26b78e -->
+<!-- noodle-skill version:0.83.0 hash:6ef6ef551e26b78e -->
 
 # verifying-mcp-delivery
 

package/skills/codex/wrapping-existing-applications/SKILL.md

@@ -3,7 +3,7 @@ name: wrapping-existing-applications
 description: "Use when an existing application has no stable usable API and needs a read-only, identity-first Noodle Seed integration plan before implementation."
 ---
 
-<!-- noodle-skill version:0.81.0 hash:eccc3c158dcafba8 -->
+<!-- noodle-skill version:0.83.0 hash:eccc3c158dcafba8 -->
 
 # wrapping-existing-applications