@noodleseed/one 0.139.4 → 0.141.0

package/node_modules/@noodle-borg/runtime/dist/connector/failure-details.js

@@ -1,5 +1,6 @@
 const FAILURE_CATEGORIES = new Set([
     'timeout',
+    'queue_timeout',
     'network_error',
     'rate_limited',
     'upstream_5xx',
@@ -20,6 +21,8 @@ export function sanitizeConnectorFailureDetails(error, options = {}) {
     const responseExcerpt = options.includeResponseExcerpt
         ? ownData(error, 'responseExcerpt')
         : undefined;
+    const queueWaitMs = ownData(error, 'queueWaitMs');
+    const executionMs = ownData(error, 'executionMs');
     return Object.freeze({
         ...(isIntegerInRange(status, 100, 599) ? { status } : {}),
         ...(typeof category === 'string' && FAILURE_CATEGORIES.has(category)
@@ -31,6 +34,8 @@ export function sanitizeConnectorFailureDetails(error, options = {}) {
         ...(typeof responseExcerpt === 'string' && responseExcerpt.length <= MAX_RESPONSE_EXCERPT_LENGTH
             ? { responseExcerpt }
             : {}),
+        ...(isIntegerInRange(queueWaitMs, 0, MAX_RETRY_AFTER_MS) ? { queueWaitMs } : {}),
+        ...(isIntegerInRange(executionMs, 0, MAX_RETRY_AFTER_MS) ? { executionMs } : {}),
     });
 }
 function ownData(error, key) {

package/node_modules/@noodle-borg/runtime/dist/connector/types.d.ts

@@ -34,11 +34,15 @@ export interface ConnectorTraceEvent {
     readonly retryable?: boolean;
     readonly retryAfterMs?: number;
     readonly responseExcerpt?: string;
+    /** Time the call waited for an execution slot, timed independently of execution. */
+    readonly queueWaitMs?: number;
+    /** Time the call actually executed, excluding queue wait. */
+    readonly executionMs?: number;
 }
 export interface ExecutionTraceSink {
     record(event: ConnectorTraceEvent): void;
 }
-export type ConnectorFailureCategory = 'timeout' | 'network_error' | 'rate_limited' | 'upstream_5xx' | 'upstream_4xx' | 'invalid_response' | 'response_too_large';
+export type ConnectorFailureCategory = 'timeout' | 'queue_timeout' | 'network_error' | 'rate_limited' | 'upstream_5xx' | 'upstream_4xx' | 'invalid_response' | 'response_too_large';
 export declare class ConnectorInvocationError extends Error {
     readonly status?: number;
     readonly category?: ConnectorFailureCategory;
@@ -46,6 +50,8 @@ export declare class ConnectorInvocationError extends Error {
     readonly retryable?: boolean;
     readonly retryAfterMs?: number;
     readonly responseExcerpt?: string;
+    readonly queueWaitMs?: number;
+    readonly executionMs?: number;
     constructor(message: string, details?: {
         readonly status?: number;
         readonly category?: ConnectorFailureCategory;
@@ -53,6 +59,8 @@ export declare class ConnectorInvocationError extends Error {
         readonly retryable?: boolean;
         readonly retryAfterMs?: number;
         readonly responseExcerpt?: string;
+        readonly queueWaitMs?: number;
+        readonly executionMs?: number;
     });
 }
 /** Trap-free nominal classification for connector rejection values. Proxy wrappers are untrusted. */
@@ -89,6 +97,12 @@ export interface ConnectorCall {
     readonly route?: CustomerConnectorRoute;
     /** Optional host capability for sandboxed connectors; ignored by ordinary connectors. */
     readonly host?: ConnectorCallHost;
+    /**
+     * Optional execution trace sink for connector-side observability (e.g. sandbox queue-wait vs
+     * execution durations). Connectors record only flat scalar fields; the runtime still owns the
+     * failure-event path.
+     */
+    readonly trace?: ExecutionTraceSink;
 }
 /**
  * A connector: a versioned integration exposing typed operations. Phase 1 ships only an in-memory

package/node_modules/@noodle-borg/runtime/dist/connector/types.js

@@ -7,6 +7,8 @@ export class ConnectorInvocationError extends Error {
     retryable;
     retryAfterMs;
     responseExcerpt;
+    queueWaitMs;
+    executionMs;
     constructor(message, details = {}) {
         super(message);
         connectorInvocationErrors.add(this);
@@ -24,6 +26,10 @@ export class ConnectorInvocationError extends Error {
             this.retryAfterMs = details.retryAfterMs;
         if (details.responseExcerpt !== undefined)
             this.responseExcerpt = details.responseExcerpt;
+        if (details.queueWaitMs !== undefined)
+            this.queueWaitMs = details.queueWaitMs;
+        if (details.executionMs !== undefined)
+            this.executionMs = details.executionMs;
     }
 }
 /** Trap-free nominal classification for connector rejection values. Proxy wrappers are untrusted. */

package/node_modules/@noodle-borg/runtime/dist/index.d.ts

@@ -16,7 +16,7 @@ export type { InvocationContext, InvocationContextPreferenceSource, InvocationLo
 export { type ManagedOriginResolutionResult, resolveManagedOrigins, } from './managed-origins.js';
 export { AllowAllPolicy } from './policy/allow-all.js';
 export type { PolicyContext, PolicyDecision, PolicyGate } from './policy/types.js';
-export { type ConfirmationActionReview, type ConfirmationPreparationResult, type ConfirmationReview, type ElicitationRequest, type ElicitationResponse, type ExecutionError, type ExecutionErrorCode, type ExecutionResult, type InteractiveExecutionResult, isConfirmationRequired, isInputRequired, isInputRequiredForConfirmation, type PreparedOperationAction, type PreparedToolContinuation, type ToolContinuation, type ToolPreparationContinuation, } from './result.js';
+export { type ConfirmationActionReview, type ConfirmationPreparationResult, type ConfirmationReview, type ConnectorFailureAttribution, type ElicitationRequest, type ElicitationResponse, type ExecutionError, type ExecutionErrorCode, type ExecutionResult, type InteractiveExecutionResult, isConfirmationRequired, isInputRequired, isInputRequiredForConfirmation, type PreparedOperationAction, type PreparedToolContinuation, type ToolContinuation, type ToolPreparationContinuation, } from './result.js';
 export { splitResultMeta } from './result-meta.js';
 export { assertNoSecretValue, assertSchemaValue, COMPLETE_STATE_OPERATION, createStateConnector, InMemoryStateHandleStore, PATCH_STATE_OPERATION, READ_STATE_OPERATION, STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, StateConnector, type StateHandleRecord, type StateHandleStore, type StateInput, type StateMutationInput, type StatePatchInput, } from './state-handles.js';
 export type { ToolDispatchContext, ToolDispatchDecision, ToolDispatchHook, } from './tool-dispatch.js';

package/node_modules/@noodle-borg/runtime/dist/operation-execution.d.ts

@@ -29,6 +29,6 @@ export declare function prepareOperationAction(ref: ResolvedOperationRef | {
 }, argsAst: ExprMap, scope: EvalScope, deps: ExecuteDeps, argsPath: string, additionalOperationCount?: number): PreparedOperationActionResult;
 /** @internal Shared with the suspension-aware flow executor. */
 export declare function createHost(toolName: string, deps: ExecuteDeps, policy: PolicyGate, env: Record<string, string>, callStack: string[], beforeDispatch?: ToolDispatchHook): ConnectorCallHost;
-export declare function fail(code: ExecutionError['code'], message: string, pathOrDetails?: string | Pick<ExecutionError, 'reason' | 'fix' | 'next'>): ExecutionResult;
+export declare function fail(code: ExecutionError['code'], message: string, pathOrDetails?: string | Pick<ExecutionError, 'reason' | 'fix' | 'next' | 'connector'>): ExecutionResult;
 export {};
 //# sourceMappingURL=operation-execution.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/operation-execution.js

@@ -171,6 +171,7 @@ async function invokeOperation(ref, args, sig, toolName, deps, policy, host, env
                 ...(deps.caller !== undefined ? { caller: deps.caller } : {}),
                 ...(customerRoute === undefined ? {} : { route: customerRoute }),
                 host,
+                ...(deps.trace === undefined ? {} : { trace: deps.trace }),
             });
         }
         catch (error) {
@@ -189,14 +190,32 @@ async function invokeOperation(ref, args, sig, toolName, deps, policy, host, env
                     operation: ref.operation,
                     ...failureDetails,
                 });
-                if (failureDetails.category === 'response_too_large') {
-                    return fail('connector_error', `connector failed for operation "${ref.operation}"`, {
-                        reason: 'response_too_large',
-                    });
-                }
+                // Attribution keeps the sanitized classification (never the excerpt) so analytics can name
+                // the failing connector/operation/stage while the wire result stays generic (#1309).
+                const status = statusClass(failureDetails.status);
+                return fail('connector_error', `connector failed for operation "${ref.operation}"`, {
+                    ...(failureDetails.category === undefined ? {} : { reason: failureDetails.category }),
+                    connector: {
+                        connectorId: ref.connectorId,
+                        connectorVersion: ref.connectorVersion,
+                        operation: ref.operation,
+                        ...(failureDetails.category === undefined ? {} : { category: failureDetails.category }),
+                        ...(status === undefined ? {} : { statusClass: status }),
+                        ...(failureDetails.attempts === undefined ? {} : { attempts: failureDetails.attempts }),
+                        ...(failureDetails.retryable === undefined
+                            ? {}
+                            : { retryable: failureDetails.retryable }),
+                    },
+                });
             }
             // Normalize connector failures; never surface backend internals or credentials.
-            return fail('connector_error', `connector failed for operation "${ref.operation}"`);
+            return fail('connector_error', `connector failed for operation "${ref.operation}"`, {
+                connector: {
+                    connectorId: ref.connectorId,
+                    connectorVersion: ref.connectorVersion,
+                    operation: ref.operation,
+                },
+            });
         }
         if (customerRoute !== undefined) {
             const cloned = cloneRoutedOutput(output, customerRoute.baseUrl);
@@ -278,6 +297,16 @@ function hostCallErrorSnapshot(value) {
         ? hostCallErrors.get(value)
         : undefined;
 }
+/** Upstream status class for retained attribution; the exact status stays out of analytics. */
+function statusClass(status) {
+    if (status === undefined)
+        return undefined;
+    if (status >= 500 && status <= 599)
+        return '5xx';
+    if (status >= 400 && status <= 499)
+        return '4xx';
+    return undefined;
+}
 export function fail(code, message, pathOrDetails) {
     if (typeof pathOrDetails === 'string') {
         return { ok: false, error: { code, message, path: pathOrDetails } };

package/node_modules/@noodle-borg/runtime/dist/result.d.ts

@@ -1,7 +1,23 @@
 import type { CredentialProfile } from '@noodle-borg/compiler';
+import type { ConnectorFailureCategory } from './connector/types.js';
 import type { CustomerRouteBinding } from './customer-routing.js';
 /** Why a tool call could not be fulfilled. Protocol and embedded adapters map this internal contract. */
 export type ExecutionErrorCode = 'shape_only_artifact' | 'unknown_tool' | 'unknown_resource' | 'unknown_prompt' | 'unsupported_fulfilment' | 'connector_unavailable' | 'connector_route_unavailable' | 'credential_unavailable' | 'signature_drift' | 'policy_denied' | 'policy_error' | 'dispatch_denied' | 'usage_limit_exceeded' | 'duplicate_execution_suppressed' | 'execution_admission_error' | 'execution_cancelled' | 'arg_invalid' | 'invalid_continuation' | 'invalid_elicitation_flow' | 'invalid_confirmation_flow' | 'expression_error' | 'circular_call_dependency' | 'connector_error' | 'output_invalid';
+/**
+ * Safe connector failure attribution for operator analytics (issue #1309): platform identifiers and
+ * bounded classification only — never an upstream message, response body, credential, or exact URL.
+ * Adapters must keep this off every model-facing wire channel.
+ */
+export interface ConnectorFailureAttribution {
+    readonly connectorId: string;
+    readonly connectorVersion: string;
+    readonly operation: string;
+    readonly category?: ConnectorFailureCategory;
+    /** Upstream HTTP status class; the exact status is deliberately not retained. */
+    readonly statusClass?: '4xx' | '5xx';
+    readonly attempts?: number;
+    readonly retryable?: boolean;
+}
 /** A typed execution failure. `path` locates the offending field/expression when applicable and
  * never carries a sensitive value. */
 export interface ExecutionError {
@@ -10,6 +26,8 @@ export interface ExecutionError {
     readonly path?: string;
     /** Stable, allowlisted machine-readable detail. Never an upstream error message. */
     readonly reason?: string;
+    /** Present on connector failures; analytics-only, never serialized to a client. */
+    readonly connector?: ConnectorFailureAttribution;
     /** Safe monthly-allowance reset instant, present only for commercial usage denial. */
     readonly resetAt?: string;
     /** Safe remediation text intended for a developer or agent. */

package/node_modules/@noodle-borg/service/dist/auth/developer-grant-guard.js

@@ -8,7 +8,8 @@ export async function authorizeDeveloperGrant(identity, context) {
     });
     if (grant === undefined)
         return false;
-    if (developerResourcePath(grant.resource) !== context.resourcePath)
+    const grantPath = developerResourcePath(grant.resource);
+    if (grantPath === undefined || !context.resourcePaths.has(grantPath))
         return false;
     if (!grant.capabilities.includes(context.capability))
         return false;

package/node_modules/@noodle-borg/service/dist/modules/route-dispatch.js

@@ -42,7 +42,7 @@ export function createModuleRouteContext(hostRequest, deps) {
                             controlPlane: deps.controlPlane,
                             org: input.org,
                             capability: input.permission,
-                            resourcePath: DEVELOPER_CLI_PATH,
+                            resourcePaths: new Set([DEVELOPER_CLI_PATH]),
                         }));
                     if (!allowed) {
                         return forbidden('developer grant does not authorize this operation');

package/node_modules/@noodle-borg/service/dist/registry-types.d.ts

@@ -1,11 +1,11 @@
 import type { CapabilityName } from '@noodle-borg/capabilities';
 import type { CatalogConnector, HostedPackagedAsset } from '@noodle-borg/compiler';
+import type { ControlPlaneIdentity } from '@noodle-borg/control-plane/portable';
 import type { OrgMembershipSource, PolicyGate } from '@noodle-borg/module';
 import type { Connector } from '@noodle-borg/runtime';
 import type { AccessMode, OwnerTokenVerifier } from '@noodle-borg/transport-http';
 import type { DeploymentSource } from '@noodle-borg/wire-contracts';
 import type { AppPackageRenderer } from './app-package-snapshot.js';
-import type { ControlPlaneIdentity } from './auth/deploy-gate.js';
 import type { DelegatedExchangeOptions } from './delegated-token-exchange.js';
 import type { ExternalCredentialExchangeRuntimeOptions } from './external-credential-exchange.js';
 import type { GoogleWorkloadIdentityRuntimeOptions } from './google-workload-identity.js';

package/node_modules/@noodle-borg/service/dist/routes/assistant-agent.js

@@ -1,6 +1,6 @@
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
 import { requestModelCompletion, } from '@noodle-borg/assistant-gateway/model-runtime';
-import { assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, authenticatedSurfaceOf, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { guardedFetch } from '@noodle-borg/connector-http';
 import { evaluateToolAuthorization } from '@noodle-borg/protocol';
@@ -383,10 +383,22 @@ function selectTurnModelTools(target, caller, latestMessage, usedToolNames) {
         ...(usedToolNames === undefined ? {} : { usedToolNames }),
     });
 }
-/** Surface behavior is injected only when the session is pinned to the public projection that minted it. */
+/**
+ * Surface behavior is injected only for the exact surface the session is bound to (ADR 0215): the
+ * public-audience surface for embed-minted sessions, the authenticated surface for backend-exchanged
+ * ones. A session with no binding — a record from before binding existed, or a pre-surfaces artifact —
+ * fails closed to no surface block, never to a union or first-surface fallback.
+ */
 function surfaceInstructionsContext(assistant, session) {
-    if (session.publicEmbedId === undefined)
+    const bound = session.boundSurface ?? (session.publicEmbedId !== undefined ? 'public' : undefined);
+    if (bound === undefined)
         return '';
+    if (bound === 'authenticated') {
+        const surface = authenticatedSurfaceOf(assistant);
+        if (!surface?.instructions)
+            return '';
+        return `\n\nSurface instructions (authenticated website surface; same trust level as tenant instructions):\n${surface.instructions}`;
+    }
     const surface = publicSurfaceOf(assistant);
     if (!surface?.instructions)
         return '';

package/node_modules/@noodle-borg/service/dist/routes/assistant-clients.js

@@ -0,0 +1,116 @@
+import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { now } from './assistant-route-http.js';
+import { authorizeControlPlane } from './control-plane.js';
+export async function handleAssistantClients(req, res, tenant, id, action, deps) {
+    const identity = await authorizeControlPlane(req, res, deps.gate, { requireIdentity: false });
+    if (identity === false)
+        return;
+    if (identity && !identity.superAdmin) {
+        const member = await deps.controlPlane.isOrgMember({
+            org: tenant.org,
+            subject: identity.subject,
+        });
+        if (!member)
+            return sendForbidden(res, 'forbidden');
+    }
+    if (action === 'collection' && req.method === 'GET') {
+        const clients = await deps.store.listClients(tenant);
+        return sendJson(res, 200, {
+            ok: true,
+            clients: clients.map(publicClient),
+        });
+    }
+    if (action === 'collection' && req.method === 'POST') {
+        const body = await readJsonBody(req, deps.maxBody);
+        if (!body.ok)
+            return sendJson(res, body.status, { error: body.error });
+        const name = body.value.name;
+        if (typeof name !== 'string' || name.trim().length < 1 || name.length > 80) {
+            return sendJson(res, 400, { error: '"name" must be a non-empty string' });
+        }
+        const target = await deps.registry.getActiveByTenant(tenant);
+        const assistant = target?.served.artifact.server.assistant;
+        if (!target?.deploymentId || !assistant)
+            return sendJson(res, 409, { error: 'deployment has no embedded assistant' });
+        const created = await deps.store.createClient({
+            name: name.trim(),
+            tenant,
+            deploymentId: target.deploymentId,
+            allowedOrigins: assistant.allowedOrigins,
+            now: now(deps),
+        });
+        await deps.audit.emit({
+            eventType: 'assistant.client.created',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            deploymentId: target.deploymentId,
+            decision: 'allow',
+            status: 201,
+            ...(identity ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email ? { actorEmail: identity.email } : {}),
+            details: { clientId: created.client.id, name: created.client.name },
+        });
+        return sendJson(res, 201, {
+            ok: true,
+            ...publicClient(created.client),
+            clientSecret: created.secret,
+        });
+    }
+    if (!id)
+        return sendJson(res, 404, { error: 'not found' });
+    const owned = (await deps.store.listClients(tenant)).some((client) => client.id === id);
+    if (!owned)
+        return sendJson(res, 404, { error: 'not found' });
+    if (action === 'rotate' && req.method === 'POST') {
+        const rotated = await deps.store.rotateClient(id, now(deps));
+        if (!rotated)
+            return sendJson(res, 404, { error: 'not found' });
+        await deps.audit.emit({
+            eventType: 'assistant.client.rotated',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            deploymentId: rotated.client.deploymentId,
+            decision: 'allow',
+            status: 200,
+            ...(identity ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email ? { actorEmail: identity.email } : {}),
+            details: { clientId: rotated.client.id },
+        });
+        return sendJson(res, 200, {
+            ok: true,
+            ...publicClient(rotated.client),
+            clientSecret: rotated.secret,
+        });
+    }
+    if (action === 'item' && req.method === 'DELETE') {
+        await deps.store.revokeClient(id, now(deps));
+        await deps.audit.emit({
+            eventType: 'assistant.client.revoked',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            decision: 'allow',
+            status: 204,
+            ...(identity ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email ? { actorEmail: identity.email } : {}),
+            details: { clientId: id },
+        });
+        res.statusCode = 204;
+        res.end();
+        return;
+    }
+    sendJson(res, 405, { error: 'method not allowed' });
+}
+function publicClient(client) {
+    return {
+        id: client.id,
+        name: client.name,
+        createdAt: client.createdAt,
+        // Audit data only: sessions follow the tenant's active deployment, not this snapshot.
+        createdAgainstDeploymentId: client.deploymentId,
+        ...(client.revokedAt ? { revokedAt: client.revokedAt } : {}),
+    };
+}
+//# sourceMappingURL=assistant-clients.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-dispatch.js

@@ -1,10 +1,13 @@
-import { handleAssistantAppRequest, handleAssistantClients, handleAssistantPreflight, handleAssistantSession, handleAssistantTurn, handleConsoleApprovalNonce, } from './assistant.js';
+import { isAssistantSandboxHost, } from '@noodle-borg/assistant-gateway/portable';
+import { handleAssistantAppRequest, handleAssistantPreflight, handleAssistantSession, handleAssistantTurn, handleConsoleApprovalNonce, } from './assistant.js';
+import { handleAssistantClients } from './assistant-clients.js';
 import { handleAssistantDoctor } from './assistant-doctor.js';
 import { handleAssistantEmbedScript } from './assistant-embed-script.js';
 import { handleAssistantEmbeds } from './assistant-embeds.js';
 import { handleAssistantConfirmation, handleAssistantInteraction, } from './assistant-interactions.js';
 import { handlePublicAssistantSession } from './assistant-public-session.js';
 import { handleAssistantSandbox } from './assistant-sandbox.js';
+import { handleAssistantTranscript } from './assistant-transcript.js';
 export function dispatchAssistantRoutes(req, res, url, deps) {
     if (url.pathname === '/v1/console/approval-nonces/consume' && req.method === 'POST') {
         return run(req, res, deps, () => handleConsoleApprovalNonce(req, res, deps));
@@ -13,7 +16,8 @@ export function dispatchAssistantRoutes(req, res, url, deps) {
         url.pathname === '/v1/assistant/turns' ||
         url.pathname === '/v1/assistant/tool-confirmations' ||
         url.pathname === '/v1/assistant/interactions' ||
-        url.pathname === '/v1/assistant/apps') &&
+        url.pathname === '/v1/assistant/apps' ||
+        url.pathname === '/v1/assistant/transcript') &&
         req.method === 'OPTIONS') {
         deps.applySecurityHeaders(res, deps.tls);
         handleAssistantPreflight(req, res);
@@ -32,7 +36,9 @@ export function dispatchAssistantRoutes(req, res, url, deps) {
         deps.applySecurityHeaders(res, deps.tls);
         if (deps.enforceHttps(req, res, deps.tls))
             return true;
-        handleAssistantSandbox(req, res);
+        const sandboxBase = deps.sandboxBase?.(req);
+        const isolatedOrigin = isAssistantSandboxHost(req.headers.host, sandboxBase);
+        handleAssistantSandbox(req, res, { isolatedOrigin });
         return true;
     }
     if (url.pathname === '/v1/assistant/public-sessions' && req.method === 'POST') {
@@ -47,6 +53,9 @@ export function dispatchAssistantRoutes(req, res, url, deps) {
     if (url.pathname === '/v1/assistant/apps' && req.method === 'POST') {
         return run(req, res, deps, () => handleAssistantAppRequest(req, res, deps));
     }
+    if (url.pathname === '/v1/assistant/transcript' && req.method === 'POST') {
+        return run(req, res, deps, () => handleAssistantTranscript(req, res, deps));
+    }
     const doctorMatch = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/assistant\/doctor$/.exec(url.pathname);
     if (doctorMatch) {
         const tenant = decodeTenant(doctorMatch);

package/node_modules/@noodle-borg/service/dist/routes/assistant-elevation.js

@@ -93,6 +93,7 @@ export async function elevateAssistantSession(res, deps, input) {
         clientId: input.client.id,
         origin: input.origin,
         ...(input.customerRouting ? { customerRouting: input.customerRouting } : {}),
+        ...(input.boundSurface ? { boundSurface: input.boundSurface } : {}),
         resume: input.resume,
     }, {
         elevations: deps.elevations,

package/node_modules/@noodle-borg/service/dist/routes/assistant-interaction-stream.js

@@ -5,7 +5,10 @@ export async function narrateResolvedInteraction(res, deps, target, session, too
     try {
         const narration = await narrateInteractionResolution(target, session, tool, action, result, context, deps, (delta) => res.write(`event: content\ndata: ${JSON.stringify({ delta })}\n\n`));
         if (narration) {
-            await deps.store.appendHistory(session.id, [{ role: 'assistant', content: narration }]);
+            // Streamed to the panel as content deltas above, so it is genuine visible prose.
+            await deps.store.appendHistory(session.id, [
+                { role: 'assistant', content: narration, kind: 'visible' },
+            ]);
         }
     }
     catch {

package/node_modules/@noodle-borg/service/dist/routes/assistant-interactions.js

@@ -341,7 +341,12 @@ async function finishExecution(res, deps, session, interaction, context, result,
         status: 'succeeded',
     });
     await deps.store.appendHistory(session.id, [
-        { role: 'assistant', content: `Completed ${toolName}: ${JSON.stringify(safeOutput)}` },
+        // Model-facing scaffolding: the panel saw the tool_completed card, never this row's tool JSON.
+        {
+            role: 'assistant',
+            content: `Completed ${toolName}: ${JSON.stringify(safeOutput)}`,
+            kind: 'narration',
+        },
     ]);
     writeInteractionSseHeaders(res, session.origin);
     writeInteractionResolved(res, interaction.id, 'accept');
@@ -412,9 +417,11 @@ async function resolveStop(res, deps, session, interaction, action) {
     });
     const toolName = assistantInteractionTool(completion.interaction) ?? 'tool request';
     await deps.store.appendHistory(session.id, [
+        // Model-facing scaffolding: the panel saw the interaction resolve, never this summary row.
         {
             role: 'assistant',
             content: `${action === 'decline' ? 'Declined' : 'Cancelled'} ${toolName}; it was not executed.`,
+            kind: 'narration',
         },
     ]);
     writeInteractionSseHeaders(res, session.origin);

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-session.js

@@ -5,7 +5,7 @@ import { assistantSessionUsageRequestEvent, captureAssistantUsage, } from '@nood
 import { assistantSessionResponseSchema } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendJson } from '../http-util.js';
 import { assistantBrowserConfiguration } from './assistant-configuration.js';
-import { applyBrowserCors, now } from './assistant-route-http.js';
+import { applyBrowserCors, assistantSessionEndpoints, now } from './assistant-route-http.js';
 /**
  * The transport half of anonymous session minting. Every decision — which refusal, in which order, and
  * whether the surface may serve at all — lives in `@noodle-borg/assistant-gateway`; this file parses a
@@ -76,6 +76,7 @@ export async function handlePublicAssistantSession(req, res, deps) {
                     : 'operator',
                 origin: input.origin,
                 publicEmbedId: input.embed.embedId,
+                boundSurface: 'public',
                 caller: { subject: input.subject, identityKind: 'anonymous' },
                 ...(configuration ? { configuration } : {}),
                 createdAt: current.toISOString(),
@@ -94,17 +95,10 @@ export async function handlePublicAssistantSession(req, res, deps) {
     }
     // Only here, with the origin proven against the live surface, may the page read the response.
     applyBrowserCors(req, res, origin);
-    const base = deps.serviceBase(req);
     const sessionBody = {
         token: result.token,
         expiresAt: result.expiresAt,
-        endpoints: {
-            turns: `${base}/v1/assistant/turns`,
-            toolConfirmations: `${base}/v1/assistant/tool-confirmations`,
-            interactions: `${base}/v1/assistant/interactions`,
-            apps: `${base}/v1/assistant/apps`,
-            sandbox: `${base}/v1/assistant/sandbox`,
-        },
+        endpoints: assistantSessionEndpoints(deps.serviceBase(req), deps.sandboxBase?.(req)),
         ...(configuration ? { configuration } : {}),
     };
     // Parse rather than trust: every published @noodleseed/assistant widget consumes this shape, and the

package/node_modules/@noodle-borg/service/dist/routes/assistant-route-http.js

@@ -47,4 +47,15 @@ export function applyBrowserCors(req, res, expectedOrigin) {
 export function now(deps) {
     return deps.clock?.() ?? new Date();
 }
+/** The one endpoint map every session mint returns; three mints, one source of truth. */
+export function assistantSessionEndpoints(base, sandboxBase = base) {
+    return {
+        turns: `${base}/v1/assistant/turns`,
+        toolConfirmations: `${base}/v1/assistant/tool-confirmations`,
+        interactions: `${base}/v1/assistant/interactions`,
+        apps: `${base}/v1/assistant/apps`,
+        sandbox: `${sandboxBase}/v1/assistant/sandbox`,
+        transcript: `${base}/v1/assistant/transcript`,
+    };
+}
 //# sourceMappingURL=assistant-route-http.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-sandbox.js

@@ -1,58 +1,23 @@
-/**
- * Hosted widget sandbox document (ADR 0151 addendum). The embedded assistant renders MCP App
- * widgets in a double iframe; when the outer frame is an `about:srcdoc` document it inherits the
- * customer page's CSP, so a strict `script-src` silently blanks every widget. Serving this relay
- * document from the service origin gives it — and the inner `srcdoc` widget document that inherits
- * from it — a CSP the platform controls. The body is pinned byte-for-byte to
- * `contract/v1/assistant-sandbox-document.html` and to the published client's srcdoc fallback; any
- * relay-protocol change is a coordinated contract event, never a local edit.
- */
-export const ASSISTANT_SANDBOX_DOCUMENT = `<!doctype html><meta charset="utf-8"><style>html,body,iframe{border:0;margin:0;width:100%;height:100%;overflow:hidden}body{background:transparent}</style><script>
-let inner;
-const ready={jsonrpc:'2.0',method:'ui/notifications/sandbox-proxy-ready',params:{}};
-// Re-announce until the host acknowledges with the resource: when this document is hosted
-// cross-origin, the first announcement can arrive before the host's load handler is listening.
-const announce=setInterval(()=>parent.postMessage(ready,'*'),120);
-setTimeout(()=>clearInterval(announce),15000);
-addEventListener('message',(event)=>{
-  if(event.source===parent){
-    const message=event.data;
-    if(message?.method==='ui/notifications/sandbox-resource-ready'){
-      clearInterval(announce);
-      if(inner)return;
-      inner=document.createElement('iframe');
-      inner.setAttribute('sandbox',message.params?.sandbox||'allow-scripts');
-      inner.setAttribute('referrerpolicy','no-referrer');
-      inner.srcdoc=String(message.params?.html||'');
-      document.body.replaceChildren(inner);
-      return;
-    }
-    inner?.contentWindow?.postMessage(message,'*');
-  } else if(inner && event.source===inner.contentWindow) {
-    parent.postMessage(event.data,'*');
-  }
-});
-parent.postMessage(ready,'*');
-</script>`;
-/**
- * The sandbox document's own CSP. `sandbox allow-scripts` forces an opaque origin server-side even
- * if a future embedder frames the URL without a sandbox attribute (the document can never read
- * service cookies or storage); inline script/style must be allowed because the relay script and the
- * inner widget document's injected bridge are inline by design; everything else stays closed —
- * widget data flows only over the postMessage bridge, never direct fetch.
- */
-const SANDBOX_CSP = "sandbox allow-scripts; default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src https: data: blob:; font-src https: data:; frame-src about:; form-action 'none'; base-uri 'none'; frame-ancestors *";
-/** Serve the static, secret-free sandbox document. GET-only; cacheable despite the no-store baseline. */
-export function handleAssistantSandbox(req, res) {
+import { ASSISTANT_SANDBOX_DOCUMENT, resolveAssistantSandboxResponsePolicy, } from '@noodle-borg/assistant-gateway/portable';
+/** Serve the static, secret-free sandbox relay and apply its validated CSP before writing the body. */
+export function handleAssistantSandbox(req, res, options = {}) {
     if (req.method !== 'GET') {
         res.statusCode = 405;
         res.setHeader('Allow', 'GET');
         res.end();
         return;
     }
+    const policy = resolveAssistantSandboxResponsePolicy(req.url ?? '/', options.isolatedOrigin === true);
+    res.setHeader('Content-Security-Policy', policy.contentSecurityPolicy);
+    if (!policy.ok) {
+        res.statusCode = 400;
+        res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+        res.setHeader('Cache-Control', 'no-store');
+        res.end('Invalid sandbox policy');
+        return;
+    }
     res.statusCode = 200;
     res.setHeader('Content-Type', 'text/html; charset=utf-8');
-    res.setHeader('Content-Security-Policy', SANDBOX_CSP);
     res.setHeader('Cache-Control', 'public, max-age=300');
     res.end(ASSISTANT_SANDBOX_DOCUMENT);
 }