npm - @noodleseed/agent-kit - Versions diffs - 0.92.0 → 0.93.0 - Mend

@noodleseed/agent-kit 0.92.0 → 0.93.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (40) hide show

package/skills/codex/examples/acme-discovery/site/index.html ADDED Viewed

@@ -0,0 +1,189 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Acme Getaways — small-group trips</title>
+    <style>
+      :root {
+        --ac-teal: #0ea5a4;
+        --ac-ink: #0b1b1b;
+        --ac-slate: #234a48;
+        --ac-line: #e6e8ec;
+      }
+      * {
+        box-sizing: border-box;
+      }
+      body {
+        margin: 0;
+        font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+        background: #f4f5f7;
+        color: #1a1d22;
+        line-height: 1.55;
+      }
+      header {
+        background: var(--ac-ink);
+        color: #fff;
+        border-bottom: 3px solid var(--ac-teal);
+        padding: 34px 24px 30px;
+      }
+      header .wrap,
+      main {
+        max-width: 900px;
+        margin: 0 auto;
+      }
+      header h1 {
+        margin: 0;
+        font-size: 28px;
+        letter-spacing: -0.5px;
+      }
+      header h1 span {
+        color: var(--ac-teal);
+      }
+      header p {
+        margin: 6px 0 0;
+        font-size: 14px;
+        color: #9db3b1;
+      }
+      main {
+        padding: 32px 24px 96px;
+      }
+      .lede {
+        font-size: 16px;
+        color: var(--ac-slate);
+        margin: 0 0 28px;
+        max-width: 60ch;
+      }
+      .listings {
+        display: grid;
+        gap: 16px;
+        grid-template-columns: repeat(auto-fill, minmax(260px, 1fr));
+        list-style: none;
+        margin: 0;
+        padding: 0;
+      }
+      .listing {
+        background: #fff;
+        border: 1px solid var(--ac-line);
+        border-radius: 12px;
+        padding: 18px 20px;
+      }
+      .listing-name {
+        margin: 0;
+        font-size: 18px;
+        color: var(--ac-ink);
+      }
+      .listing-region {
+        margin: 2px 0 12px;
+        font-size: 12px;
+        letter-spacing: 0.6px;
+        text-transform: uppercase;
+        color: var(--ac-teal);
+        font-weight: 700;
+      }
+      .listing p {
+        margin: 0 0 12px;
+        font-size: 14px;
+        color: #4a545c;
+      }
+      .listing dl {
+        display: flex;
+        gap: 20px;
+        margin: 0;
+        font-size: 13px;
+        color: var(--ac-slate);
+      }
+      .listing dt {
+        font-size: 11px;
+        letter-spacing: 0.5px;
+        text-transform: uppercase;
+        color: #8a929c;
+      }
+      .listing dd {
+        margin: 0;
+        font-weight: 600;
+      }
+      footer {
+        border-top: 1px solid var(--ac-line);
+        margin-top: 40px;
+        padding-top: 20px;
+        font-size: 13px;
+        color: #8a929c;
+      }
+    </style>
+  </head>
+  <body>
+    <header>
+      <div class="wrap">
+        <h1><span>Acme</span> Getaways</h1>
+        <p>Small-group trips, planned in a conversation.</p>
+      </div>
+    </header>
+    <main>
+      <p class="lede">
+        Four places we know well. Ask the assistant in the corner to narrow them down, or let the
+        browser agent you already run do it for you — it can call the same tools, under the same
+        rules.
+      </p>
+      <ul class="listings">
+        <li class="listing">
+          <h3 class="listing-name">Coral Bay</h3>
+          <p class="listing-region">Adriatic coast</p>
+          <p>Calm swimming coves and a walkable old town — easy for a relaxed first trip.</p>
+          <dl>
+            <div><dt>From</dt><dd>$890</dd></div>
+            <div><dt>Best months</dt><dd>May–Sep</dd></div>
+          </dl>
+        </li>
+        <li class="listing">
+          <h3 class="listing-name">Monte Alto</h3>
+          <p class="listing-region">Northern Alps</p>
+          <p>Ski-in village with beginner slopes and long groomed runs.</p>
+          <dl>
+            <div><dt>From</dt><dd>$1,120</dd></div>
+            <div><dt>Best months</dt><dd>Dec–Mar</dd></div>
+          </dl>
+        </li>
+        <li class="listing">
+          <h3 class="listing-name">Old Quarter</h3>
+          <p class="listing-region">Central Europe</p>
+          <p>Dense museum district and food halls, all reachable on foot.</p>
+          <dl>
+            <div><dt>From</dt><dd>$640</dd></div>
+            <div><dt>Best months</dt><dd>Apr–Oct</dd></div>
+          </dl>
+        </li>
+        <li class="listing">
+          <h3 class="listing-name">Harbor City</h3>
+          <p class="listing-region">Pacific rim</p>
+          <p>Waterfront nightlife and day-trip islands a short ferry away.</p>
+          <dl>
+            <div><dt>From</dt><dd>$980</dd></div>
+            <div><dt>Best months</dt><dd>Sep–Nov</dd></div>
+          </dl>
+        </li>
+      </ul>
+      <footer>
+        A fictional brand, for demonstration. Every destination, price, and link is invented.
+      </footer>
+    </main>
+    <!--
+      The whole integration: one line, the same one a customer pastes.
+      The embed mounts <noodle-assistant>, mints a session against the public surface declared in
+      `src/server.ts`, and — because that surface sets `webmcp: { enabled: true }` — registers the
+      session's projected tools with `document.modelContext` where the browser offers it. A browser
+      agent then sees `discover_getaways`, `create_handoff`, `capture_lead` and the rest, and calling
+      one carries exactly this session's authority: the same allowlist, the same confirmation cards,
+      the same budgets and audit trail as the panel. Browsers without the API ignore all of it.
+      The id below is fictional. Run `noodle deploy` on this example to mint your own, paste it here,
+      and add this page's origin to the `publicWebsite` origins list.
+    -->
+    <script src="https://cloud.noodleseed.dev/v1/assistant/embed.js" data-embed-id="pub_examplepublicembedid00"></script>
+  </body>
+</html>

package/skills/codex/examples/acme-discovery/src/server.ts CHANGED Viewed

@@ -343,6 +343,11 @@ export default server(
       access: [
         publicWebsite({
           origins: ['https://getaways.acme.example'],
+          // A browser agent on Acme's marketing page (Gemini-in-Chrome, Claude-in-Chrome) discovers
+          // exactly the capabilities listed below and reaches them over the same authorization,
+          // confirmation, budget, and audit path the panel's own calls take: `capture_lead` still
+          // stops for its confirmation card. `site/index.html` is the page this runs on.
+          webmcp: { enabled: true },
           capabilities: [
             destinations,
             discoverGetaways,

package/skills/codex/examples/acme-discovery/test/server.test.ts CHANGED Viewed

@@ -69,6 +69,24 @@ describe('acme-discovery example', () => {
     expect(manifest.server.assistant?.labels?.signUpAction).toBe('Create free account');
   });
+  it('opens the marketing surface to browser agents and leaves the account surface closed', async () => {
+    const manifest = await app.toManifest();
+    const surfaces = manifest.server.assistant?.surfaces ?? [];
+    // Both front doors, asserted by count first: without it the per-surface claims below read a
+    // missing surface as `undefined` and pass, so deleting a surface would silently satisfy them.
+    expect(surfaces).toHaveLength(2);
+    // ADR 0220: the opt-in governs *discovery* — whether the embed registers this session's already
+    // projected tools with `document.modelContext`. A browser agent on Acme's marketing page reaches
+    // exactly the six capabilities above, over the same authorization, confirmation, and budget path
+    // the panel's own calls take. `capture_lead` still stops for its confirmation card.
+    expect(surfaces[0]?.webmcp).toEqual({ enabled: true });
+    // Per-surface opt-in exists so the two front doors can answer differently, and here they do: the
+    // signed-in account surface carries a traveler's identity, so its tools are not advertised to
+    // whatever agent happens to be running in that browser.
+    expect(surfaces[1]?.webmcp).toBeUndefined();
+  });
   it('declares the grounded knowledge component and its live site scope', async () => {
     const manifest = (await app.toManifest()) as { server: { knowledge?: unknown[] } };
     // One declaration: controlled files plus the live public site, compiled later into the

package/skills/codex/examples/acme-discovery/test/site-page.test.ts ADDED Viewed

@@ -0,0 +1,50 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import app from '../src/server.js';
+/**
+ * `site/index.html` is the demo half of the WebMCP story (ADR 0220): the marketing page a browser
+ * agent actually visits. The compiled server says the marketing surface opts in; only a real page
+ * running the real snippet shows what that buys.
+ *
+ * These guard the two properties that make the demo honest rather than the markup, which is meant to
+ * be edited: the page mounts the published one-liner and nothing else, and it never advertises a
+ * getaway the server cannot discuss.
+ */
+const page = readFileSync(join(import.meta.dirname, '..', 'site', 'index.html'), 'utf8');
+describe('the acme-discovery demo page', () => {
+  it('mounts the assistant with the published one-line snippet', () => {
+    expect(page).toContain('<script src="https://cloud.noodleseed.dev/v1/assistant/embed.js"');
+    expect(page).toMatch(/data-embed-id="pub_[a-z0-9]{20,64}"/u);
+  });
+  it('carries bootstrap markup only, so the page never borrows the session itself', () => {
+    // The bridge lives in the embed bundle, where it runs under the session's authority and budgets.
+    // Page-local JavaScript reaching for the same tools would carry none of that, so there is none:
+    // the demo's only script is the snippet above, and it has no body of its own.
+    expect(page.match(/<script\b/gu)).toHaveLength(1);
+    expect(page).toMatch(/data-embed-id="pub_[a-z0-9]{20,64}"><\/script>/u);
+  });
+  it('is a placeholder deployment, not a live embed anyone can point at', () => {
+    // Copying this file must not aim a stranger's page at a real deployment, so the id is fictional
+    // and the README says how to mint your own.
+    expect(page).toContain('pub_examplepublicembedid00');
+    expect(page).toContain('noodle deploy');
+  });
+  it('offers only getaways the server can actually discuss', async () => {
+    const catalog = JSON.stringify(await app.toManifest());
+    const offered = [...page.matchAll(/<h3 class="listing-name">([^<]+)<\/h3>/gu)].map(
+      (match) => match[1],
+    );
+    expect(offered.length).toBeGreaterThan(2);
+    for (const name of offered) {
+      expect(catalog, `${name} is on the page but not in the server's catalog`).toContain(name);
+    }
+  });
+});

package/skills/codex/executing-noodle-plans/SKILL.md CHANGED Viewed

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
-<!-- noodle-skill version:0.92.0 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.93.0 hash:6a9f132ddb79352e -->
 # Execute a Noodle Seed implementation plan

package/skills/codex/publishing-mcp-integrations/SKILL.md CHANGED Viewed

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
-<!-- noodle-skill version:0.92.0 hash:0ccafb222038f553 -->
+<!-- noodle-skill version:0.93.0 hash:0ccafb222038f553 -->
 # publishing-mcp-integrations

package/skills/codex/reporting-noodle-feedback/SKILL.md CHANGED Viewed

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
-<!-- noodle-skill version:0.92.0 hash:660cc6ad9469d90f -->
+<!-- noodle-skill version:0.93.0 hash:660cc6ad9469d90f -->
 # reporting-noodle-feedback

package/skills/codex/verifying-mcp-delivery/SKILL.md CHANGED Viewed

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
-<!-- noodle-skill version:0.92.0 hash:292253cbaed9a3c5 -->
+<!-- noodle-skill version:0.93.0 hash:292253cbaed9a3c5 -->
 # verifying-mcp-delivery

package/skills/codex/wrapping-existing-applications/SKILL.md CHANGED Viewed

@@ -3,7 +3,7 @@ name: wrapping-existing-applications
 description: "Use when an existing application has no stable usable API and needs a read-only, identity-first Noodle Seed integration plan before implementation."
 ---
-<!-- noodle-skill version:0.92.0 hash:379ab9f64878f1fe -->
+<!-- noodle-skill version:0.93.0 hash:379ab9f64878f1fe -->
 # wrapping-existing-applications