@noodleseed/one 0.140.0 → 0.141.0

package/node_modules/@noodle-borg/service/dist/routes/assistant.js

@@ -1,5 +1,5 @@
 import { clientAddressBucket, } from '@noodle-borg/admission-limits/portable';
-import { ASSISTANT_SESSION_IDLE_MS, dispatchAssistantTool, parseAssistantContextPreferences, parseAssistantCustomerRouting, resumeTurnMessage, shouldAutoResume, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { ASSISTANT_SESSION_IDLE_MS, dispatchAssistantTool, parseAssistantContextPreferences, parseAssistantCustomerRouting, resumeTurnMessage, resumeUnavailableMessage, shouldAutoResume, surfaceBindingForOrigin, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { canonicalizeAuthorizationClaimValues } from '@noodle-borg/auth';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { tenantMcpUrl } from '@noodle-borg/module';
@@ -14,7 +14,7 @@ import { assistantBrowserConfiguration } from './assistant-configuration.js';
 import { elevateAssistantSession } from './assistant-elevation.js';
 import { executeAssistantKnowledgeSearch, findAssistantKnowledgeComponent, resolveAssistantKnowledge, } from './assistant-knowledge.js';
 import { refusePublicTurn } from './assistant-public-turn.js';
-import { applyBrowserCors, authenticateSession, handleAssistantPreflight, now, } from './assistant-route-http.js';
+import { applyBrowserCors, assistantSessionEndpoints, authenticateSession, handleAssistantPreflight, now, } from './assistant-route-http.js';
 import { sessionScopedTarget } from './assistant-session-target.js';
 import { authorizeControlPlane } from './control-plane.js';
 export { applyBrowserCors, authenticateSession, handleAssistantPreflight, now };
@@ -42,108 +42,6 @@ export async function handleConsoleApprovalNonce(req, res, deps) {
     const consumed = await deps.store.consumeConsoleApprovalNonce(nonce, identity.subject, expiry, current);
     return sendJson(res, consumed ? 201 : 409, consumed ? { ok: true } : { ok: false, error: 'already_used_or_expired' });
 }
-export async function handleAssistantClients(req, res, tenant, id, action, deps) {
-    const identity = await authorizeControlPlane(req, res, deps.gate, { requireIdentity: false });
-    if (identity === false)
-        return;
-    if (identity && !identity.superAdmin) {
-        const member = await deps.controlPlane.isOrgMember({
-            org: tenant.org,
-            subject: identity.subject,
-        });
-        if (!member)
-            return sendForbidden(res, 'forbidden');
-    }
-    if (action === 'collection' && req.method === 'GET') {
-        const clients = await deps.store.listClients(tenant);
-        return sendJson(res, 200, {
-            ok: true,
-            clients: clients.map(publicClient),
-        });
-    }
-    if (action === 'collection' && req.method === 'POST') {
-        const body = await readJsonBody(req, deps.maxBody);
-        if (!body.ok)
-            return sendJson(res, body.status, { error: body.error });
-        const name = body.value.name;
-        if (typeof name !== 'string' || name.trim().length < 1 || name.length > 80) {
-            return sendJson(res, 400, { error: '"name" must be a non-empty string' });
-        }
-        const target = await deps.registry.getActiveByTenant(tenant);
-        const assistant = target?.served.artifact.server.assistant;
-        if (!target?.deploymentId || !assistant)
-            return sendJson(res, 409, { error: 'deployment has no embedded assistant' });
-        const created = await deps.store.createClient({
-            name: name.trim(),
-            tenant,
-            deploymentId: target.deploymentId,
-            allowedOrigins: assistant.allowedOrigins,
-            now: now(deps),
-        });
-        await deps.audit.emit({
-            eventType: 'assistant.client.created',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            deploymentId: target.deploymentId,
-            decision: 'allow',
-            status: 201,
-            ...(identity ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email ? { actorEmail: identity.email } : {}),
-            details: { clientId: created.client.id, name: created.client.name },
-        });
-        return sendJson(res, 201, {
-            ok: true,
-            ...publicClient(created.client),
-            clientSecret: created.secret,
-        });
-    }
-    if (!id)
-        return sendJson(res, 404, { error: 'not found' });
-    const owned = (await deps.store.listClients(tenant)).some((client) => client.id === id);
-    if (!owned)
-        return sendJson(res, 404, { error: 'not found' });
-    if (action === 'rotate' && req.method === 'POST') {
-        const rotated = await deps.store.rotateClient(id, now(deps));
-        if (!rotated)
-            return sendJson(res, 404, { error: 'not found' });
-        await deps.audit.emit({
-            eventType: 'assistant.client.rotated',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            deploymentId: rotated.client.deploymentId,
-            decision: 'allow',
-            status: 200,
-            ...(identity ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email ? { actorEmail: identity.email } : {}),
-            details: { clientId: rotated.client.id },
-        });
-        return sendJson(res, 200, {
-            ok: true,
-            ...publicClient(rotated.client),
-            clientSecret: rotated.secret,
-        });
-    }
-    if (action === 'item' && req.method === 'DELETE') {
-        await deps.store.revokeClient(id, now(deps));
-        await deps.audit.emit({
-            eventType: 'assistant.client.revoked',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            decision: 'allow',
-            status: 204,
-            ...(identity ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email ? { actorEmail: identity.email } : {}),
-            details: { clientId: id },
-        });
-        res.statusCode = 204;
-        res.end();
-        return;
-    }
-    sendJson(res, 405, { error: 'method not allowed' });
-}
 export async function handleAssistantSession(req, res, deps) {
     const usageStartedAt = performance.now();
     const credentials = basicCredentials(req);
@@ -173,6 +71,13 @@ export async function handleAssistantSession(req, res, deps) {
     if (!assistant.allowedOrigins.includes(parsed.origin)) {
         return sendForbidden(res, 'origin is not allowed');
     }
+    // Every session binds one exact authored surface (ADR 0201): the origin selects it, and an origin no
+    // surface owns is refused rather than admitted against the deployment-wide union. A pre-surfaces
+    // artifact has no surfaces to select from; its union remains its whole released contract.
+    const surfaceBinding = surfaceBindingForOrigin(assistant, parsed.origin);
+    if (surfaceBinding.kind === 'unowned') {
+        return sendForbidden(res, 'origin is not allowed');
+    }
     const customerRouting = parseAssistantCustomerRouting(target.served.artifact.customerEndpoints, parsed.routing);
     if (!customerRouting.ok) {
         return sendJson(res, 400, {
@@ -229,18 +134,15 @@ export async function handleAssistantSession(req, res, deps) {
             client,
             resume: shouldAutoResume(parsed.resume),
             origin: parsed.origin,
+            // The conversation lands on the surface owning the (validated) landing origin: signing in on
+            // the app surface continues under its projection (ADR 0201 amendment 2026-08-26).
+            ...(surfaceBinding.kind === 'pre-surfaces' ? {} : { boundSurface: surfaceBinding.kind }),
             ...(customerRouting.customerRouting
                 ? { customerRouting: customerRouting.customerRouting }
                 : {}),
             caller,
             configuration,
-            endpoints: {
-                turns: `${deps.serviceBase(req)}/v1/assistant/turns`,
-                toolConfirmations: `${deps.serviceBase(req)}/v1/assistant/tool-confirmations`,
-                interactions: `${deps.serviceBase(req)}/v1/assistant/interactions`,
-                apps: `${deps.serviceBase(req)}/v1/assistant/apps`,
-                sandbox: `${deps.serviceBase(req)}/v1/assistant/sandbox`,
-            },
+            endpoints: assistantSessionEndpoints(deps.serviceBase(req), deps.sandboxBase?.(req)),
         });
     }
     const session = await deps.store.createSession({
@@ -249,6 +151,7 @@ export async function handleAssistantSession(req, res, deps) {
         deploymentId: target.deploymentId,
         modelSource: assistant.model.kind === 'noodle-managed' ? 'noodle-managed' : 'operator',
         origin: parsed.origin,
+        ...(surfaceBinding.kind === 'pre-surfaces' ? {} : { boundSurface: surfaceBinding.kind }),
         ...(customerRouting.customerRouting
             ? { customerRouting: customerRouting.customerRouting }
             : {}),
@@ -263,13 +166,7 @@ export async function handleAssistantSession(req, res, deps) {
     const sessionBody = {
         token: session.token,
         expiresAt: session.session.expiresAt,
-        endpoints: {
-            turns: `${deps.serviceBase(req)}/v1/assistant/turns`,
-            toolConfirmations: `${deps.serviceBase(req)}/v1/assistant/tool-confirmations`,
-            interactions: `${deps.serviceBase(req)}/v1/assistant/interactions`,
-            apps: `${deps.serviceBase(req)}/v1/assistant/apps`,
-            sandbox: `${deps.serviceBase(req)}/v1/assistant/sandbox`,
-        },
+        endpoints: assistantSessionEndpoints(deps.serviceBase(req), deps.sandboxBase?.(req)),
         ...(configuration ? { configuration } : {}),
     };
     // Every published @noodleseed/assistant widget consumes this shape; parse (don't just test)
@@ -293,6 +190,7 @@ export async function handleAssistantTurn(req, res, deps) {
     const addressBucket = clientAddressBucket(typeof req.headers['x-forwarded-for'] === 'string' ? req.headers['x-forwarded-for'] : undefined);
     let turn;
     let message;
+    let resumedTool;
     if (isRecord(body.value) && 'resume' in body.value) {
         // The one-shot post-sign-in resume (issue #1177): no user text, the pending intent is server
         // state. Admission runs FIRST so a refused resume stays armed for a retry; the consume is a
@@ -313,6 +211,7 @@ export async function handleAssistantTurn(req, res, deps) {
             });
         }
         message = resumeTurnMessage(pending.tool);
+        resumedTool = pending.tool;
         await deps.audit.emit({
             eventType: 'assistant.session.resumed',
             org: session.tenant.org,
@@ -361,6 +260,12 @@ export async function handleAssistantTurn(req, res, deps) {
     const target = await sessionScopedTarget(deps.registry, session);
     if (!target)
         return sendJson(res, 409, { error: 'assistant deployment is unavailable' });
+    if (resumedTool !== undefined &&
+        !target.served.artifact.tools.some((tool) => tool.name === resumedTool)) {
+        // The elevation landed on a surface whose projection does not offer the intercepted tool: fail
+        // closed to an honest explanation instead of asking the model to call a tool it cannot see.
+        message = resumeUnavailableMessage(resumedTool);
+    }
     const clientContext = turn?.clientContext === undefined
         ? undefined
         : parseAssistantContextPreferences(turn.clientContext);
@@ -396,8 +301,11 @@ export async function handleAssistantTurn(req, res, deps) {
             .map((event) => String(event.data.delta ?? ''))
             .join('');
         await deps.store.appendHistory(session.id, [
-            { role: 'user', content: message.trim() },
-            ...(assistantContent ? [{ role: 'assistant', content: assistantContent }] : []),
+            // A resume turn's user row is the [platform] prompt the visitor never typed or saw.
+            { role: 'user', content: message.trim(), kind: turn ? 'visible' : 'narration' },
+            ...(assistantContent
+                ? [{ role: 'assistant', content: assistantContent, kind: 'visible' }]
+                : []),
         ]);
     }
     catch {
@@ -559,14 +467,4 @@ function isContext(value) {
                 typeof item === 'boolean' ||
                 (typeof item === 'string' && item.length <= 2_000))));
 }
-function publicClient(client) {
-    return {
-        id: client.id,
-        name: client.name,
-        createdAt: client.createdAt,
-        // Audit data only: sessions follow the tenant's active deployment, not this snapshot.
-        createdAgainstDeploymentId: client.deploymentId,
-        ...(client.revokedAt ? { revokedAt: client.revokedAt } : {}),
-    };
-}
 //# sourceMappingURL=assistant.js.map

package/node_modules/@noodle-borg/service/dist/routes/config-values.js

@@ -94,7 +94,7 @@ function developerConfigAccess(grants, controlPlane, ref, method) {
             controlPlane,
             org: ref.scope.org,
             capability: method === 'GET' ? 'cloud:read' : 'config:write',
-            resourcePath: DEVELOPER_CLI_PATH,
+            resourcePaths: new Set([DEVELOPER_CLI_PATH]),
         },
     };
 }

package/node_modules/@noodle-borg/service/dist/routes/control-plane.js

@@ -1,6 +1,6 @@
 import { cspFaultsInManifest } from '@noodle-borg/compiler';
 import { ensurePersonalWorkspace } from '@noodle-borg/control-plane/portable';
-import { DEVELOPER_CLI_PATH } from '@noodle-borg/developer-mcp';
+import { DEVELOPER_ASSISTANT_PATH, DEVELOPER_CLI_PATH, } from '@noodle-borg/developer-mcp';
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { noopLogger } from '@noodle-borg/transport-http';
 import { deployRequestSchema, formatWireError, } from '@noodle-borg/wire-contracts';
@@ -504,9 +504,15 @@ export async function handleDeploymentStatus(req, res, registry, gate, controlPl
     }
 }
 export function developerGrantRouteAccess(grants, capability) {
+    // Control-plane routes serve the CLI resource and the assistant resource (ADR 0218); the grant's
+    // own capability ceiling — never this set — decides what each may actually do.
     return grants === undefined
         ? undefined
-        : { grants, capability, resourcePath: DEVELOPER_CLI_PATH };
+        : {
+            grants,
+            capability,
+            resourcePaths: new Set([DEVELOPER_CLI_PATH, DEVELOPER_ASSISTANT_PATH]),
+        };
 }
 async function authorizeHumanDeploy(req, res, options, gate, controlPlane, org) {
     const developerAccess = developerGrantAccess(options.developerGrantStore, controlPlane, org, 'deployments:write');

package/node_modules/@noodle-borg/service/dist/service.js

@@ -1,4 +1,4 @@
-import { InMemoryAssistantStore } from '@noodle-borg/assistant-gateway/portable';
+import { InMemoryAssistantStore, isAssistantSandboxHost, validateAssistantSandboxBaseUrl, } from '@noodle-borg/assistant-gateway/portable';
 import { allowAllGate, InMemoryControlPlaneStore } from '@noodle-borg/control-plane/portable';
 import { dispatchKnowledgeRequest } from '@noodle-borg/knowledge-operations/portable';
 import { OPENAI_APPS_CHALLENGE_PATH } from '@noodle-borg/module';
@@ -50,6 +50,9 @@ const DEFAULT_MAX_BODY = 1 << 20;
 const DEFAULT_MAX_DEPLOY_BODY = 32 * 1024 * 1024;
 /** The combined service listener: tenant-scoped deploy management plus the multi-tenant MCP router. */
 export function createServiceHandler(registry, options = {}) {
+    const assistantSandboxBaseUrl = options.assistantSandboxBaseUrl === undefined
+        ? undefined
+        : validateAssistantSandboxBaseUrl(options.assistantSandboxBaseUrl, options.publicBaseUrl);
     const logger = options.logger ?? noopLogger;
     const tls = options.tls ?? {};
     const buildInfo = options.buildInfo ?? resolveBuildInfo();
@@ -155,6 +158,14 @@ export function createServiceHandler(registry, options = {}) {
     };
     return (req, res) => {
         const url = new URL(req.url ?? '/', 'http://localhost');
+        const onAssistantSandboxHost = isAssistantSandboxHost(req.headers.host, assistantSandboxBaseUrl);
+        if (onAssistantSandboxHost && url.pathname !== '/v1/assistant/sandbox') {
+            applySecurityHeaders(res, tls);
+            if (enforceHttps(req, res, tls))
+                return;
+            sendJson(res, 404, { error: 'not found' });
+            return;
+        }
         // Liveness/readiness probes: un-gated and **not** HTTPS-enforced — Cloud Run's internal probe is plain
         // HTTP, so enforcing HTTPS here would `426` the probe and the revision would never go healthy (ADR 0034).
         // `/healthz` is a pure liveness 200 (no store touch); `/readyz` reflects the injected readiness probe.
@@ -250,6 +261,9 @@ export function createServiceHandler(registry, options = {}) {
             audit: activeAudit,
             maxBody,
             serviceBase: (request) => options.publicBaseUrl ?? baseFromRequest(request, tls),
+            ...(assistantSandboxBaseUrl === undefined
+                ? {}
+                : { sandboxBase: () => assistantSandboxBaseUrl }),
             ...(options.assistantModelFetch !== undefined
                 ? { modelFetch: options.assistantModelFetch }
                 : {}),

package/node_modules/@noodle-borg/wire-contracts/dist/assistant.d.ts

@@ -20,6 +20,7 @@ export declare const assistantSessionResponseSchema: z.ZodObject<{
         interactions: z.ZodOptional<z.ZodURL>;
         apps: z.ZodOptional<z.ZodURL>;
         sandbox: z.ZodOptional<z.ZodURL>;
+        transcript: z.ZodOptional<z.ZodURL>;
     }, z.core.$strip>;
     configuration: z.ZodOptional<z.ZodObject<{
         branding: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -30,6 +31,22 @@ export declare const assistantSessionResponseSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type AssistantSessionResponse = z.infer<typeof assistantSessionResponseSchema>;
+/**
+ * The bounded visible transcript (ADR 0141/0201 amendments 2026-08-26): only rows that actually
+ * appeared in the panel — never tool internals, tickets, or model-facing scaffolding. Bounded by the
+ * session history window (40 messages); a read spends no turn budget. Strict, because the service
+ * parses its own response before sending, like the session exchange.
+ */
+export declare const assistantTranscriptResponseSchema: z.ZodObject<{
+    entries: z.ZodArray<z.ZodObject<{
+        role: z.ZodEnum<{
+            assistant: "assistant";
+            user: "user";
+        }>;
+        text: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AssistantTranscriptResponse = z.infer<typeof assistantTranscriptResponseSchema>;
 /** MCP-Apps-shaped, author-selected renderer summary included on one assistant turn. */
 export declare const assistantModelContextUpdateSchema: z.ZodObject<{
     content: z.ZodOptional<z.ZodArray<z.ZodObject<{

package/node_modules/@noodle-borg/wire-contracts/dist/assistant.js

@@ -42,6 +42,13 @@ export const assistantSessionResponseSchema = z.object({
          * published client falls back to the srcdoc proxy.
          */
         sandbox: z.url().optional(),
+        /**
+         * Additive bounded visible-transcript endpoint (ADR 0141/0201 amendments 2026-08-26): a
+         * session-token-authenticated POST returning what the panel may repaint after a full-page
+         * navigation — the sign-in redirect above all. Absent on older services; the widget then
+         * starts visually fresh exactly as before.
+         */
+        transcript: z.url().optional(),
     }),
     configuration: assistantSessionConfigurationSchema.optional(),
     /**
@@ -51,6 +58,24 @@ export const assistantSessionResponseSchema = z.object({
      */
     resume: z.object({ tool: z.string().min(1) }).optional(),
 });
+/**
+ * The bounded visible transcript (ADR 0141/0201 amendments 2026-08-26): only rows that actually
+ * appeared in the panel — never tool internals, tickets, or model-facing scaffolding. Bounded by the
+ * session history window (40 messages); a read spends no turn budget. Strict, because the service
+ * parses its own response before sending, like the session exchange.
+ */
+export const assistantTranscriptResponseSchema = z
+    .object({
+    entries: z
+        .array(z
+        .object({
+        role: z.enum(['user', 'assistant']),
+        text: z.string(),
+    })
+        .strict())
+        .max(40),
+})
+    .strict();
 const assistantModelContentPartSchema = z
     .object({ type: z.literal('text'), text: z.string() })
     .strict();

package/node_modules/@noodleseed/assistant/README.md

@@ -35,8 +35,8 @@ troubleshooting) lives at <https://docs.noodleseed.dev/guides/embedded-assistant
 the server itself is `@noodleseed/one` (`npm install -g @noodleseed/one`).
 
 If your page sends a `Content-Security-Policy`, allow the Noodle service origin in `connect-src` (turns and
-event streams) **and** `frame-src` (app widgets render inside a hosted sandbox document served from the
-service origin, `endpoints.sandbox`, so your `script-src` can stay strict). Details are in the guide's
+event streams) and the exact session-advertised `endpoints.sandbox` origin in `frame-src` (it may be a
+dedicated sandbox origin, so your `script-src` can stay strict). Details are in the guide's
 "Content-Security-Policy on your page" section.
 
 ## Quick start
@@ -410,13 +410,8 @@ import "@noodleseed/assistant/app-view";
 </template>
 ```
 
-Configure Vue's `isCustomElement` for `noodle-app-view`. Angular uses the same element with `[client]`,
-`[view]`, and `[theme]` property bindings. Do not serialize `client` or `view` into attributes.
-
-`<noodle-app-view>` is the canonical host; `NoodleAppView` delegates to it. Both use the
-service-advertised sandbox URL, route App calls through the supplied client, publish theme changes without
-replacing the iframe, and request standard teardown on semantic replacement, disconnect, or an App teardown
-request.
+Framework setup, lifecycle ownership, sandbox/CSP behavior, and staged diagnostics are owned by the
+[Bring your own UI guide](https://docs.noodleseed.dev/docs/guides/bring-your-own-ui).
 
 The App document owns its action intent: it calls standard `tools/call` after connecting and never relies on
 native form navigation. If that call needs input or confirmation, the same `client` publishes the normal

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.140.0",
+  "version": "0.141.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",