npm - @noodleseed/one - Versions diffs - 0.140.0 → 0.141.1 - Mend

@noodleseed/one 0.140.0 → 0.141.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (82) hide show

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-session.js CHANGED Viewed

@@ -5,7 +5,7 @@ import { assistantSessionUsageRequestEvent, captureAssistantUsage, } from '@nood
 import { assistantSessionResponseSchema } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendJson } from '../http-util.js';
 import { assistantBrowserConfiguration } from './assistant-configuration.js';
-import { applyBrowserCors, now } from './assistant-route-http.js';
+import { applyBrowserCors, assistantSessionEndpoints, now } from './assistant-route-http.js';
 /**
  * The transport half of anonymous session minting. Every decision — which refusal, in which order, and
  * whether the surface may serve at all — lives in `@noodle-borg/assistant-gateway`; this file parses a
@@ -76,6 +76,7 @@ export async function handlePublicAssistantSession(req, res, deps) {
                     : 'operator',
                 origin: input.origin,
                 publicEmbedId: input.embed.embedId,
+                boundSurface: 'public',
                 caller: { subject: input.subject, identityKind: 'anonymous' },
                 ...(configuration ? { configuration } : {}),
                 createdAt: current.toISOString(),
@@ -94,17 +95,10 @@ export async function handlePublicAssistantSession(req, res, deps) {
     }
     // Only here, with the origin proven against the live surface, may the page read the response.
     applyBrowserCors(req, res, origin);
-    const base = deps.serviceBase(req);
     const sessionBody = {
         token: result.token,
         expiresAt: result.expiresAt,
-        endpoints: {
-            turns: `${base}/v1/assistant/turns`,
-            toolConfirmations: `${base}/v1/assistant/tool-confirmations`,
-            interactions: `${base}/v1/assistant/interactions`,
-            apps: `${base}/v1/assistant/apps`,
-            sandbox: `${base}/v1/assistant/sandbox`,
-        },
+        endpoints: assistantSessionEndpoints(deps.serviceBase(req), deps.sandboxBase?.(req)),
         ...(configuration ? { configuration } : {}),
     };
     // Parse rather than trust: every published @noodleseed/assistant widget consumes this shape, and the

package/node_modules/@noodle-borg/service/dist/routes/assistant-route-http.js CHANGED Viewed

@@ -47,4 +47,15 @@ export function applyBrowserCors(req, res, expectedOrigin) {
 export function now(deps) {
     return deps.clock?.() ?? new Date();
 }
+/** The one endpoint map every session mint returns; three mints, one source of truth. */
+export function assistantSessionEndpoints(base, sandboxBase = base) {
+    return {
+        turns: `${base}/v1/assistant/turns`,
+        toolConfirmations: `${base}/v1/assistant/tool-confirmations`,
+        interactions: `${base}/v1/assistant/interactions`,
+        apps: `${base}/v1/assistant/apps`,
+        sandbox: `${sandboxBase}/v1/assistant/sandbox`,
+        transcript: `${base}/v1/assistant/transcript`,
+    };
+}
 //# sourceMappingURL=assistant-route-http.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-sandbox.js CHANGED Viewed

@@ -1,58 +1,23 @@
-/**
- * Hosted widget sandbox document (ADR 0151 addendum). The embedded assistant renders MCP App
- * widgets in a double iframe; when the outer frame is an `about:srcdoc` document it inherits the
- * customer page's CSP, so a strict `script-src` silently blanks every widget. Serving this relay
- * document from the service origin gives it — and the inner `srcdoc` widget document that inherits
- * from it — a CSP the platform controls. The body is pinned byte-for-byte to
- * `contract/v1/assistant-sandbox-document.html` and to the published client's srcdoc fallback; any
- * relay-protocol change is a coordinated contract event, never a local edit.
- */
-export const ASSISTANT_SANDBOX_DOCUMENT = `<!doctype html><meta charset="utf-8"><style>html,body,iframe{border:0;margin:0;width:100%;height:100%;overflow:hidden}body{background:transparent}</style><script>
-let inner;
-const ready={jsonrpc:'2.0',method:'ui/notifications/sandbox-proxy-ready',params:{}};
-// Re-announce until the host acknowledges with the resource: when this document is hosted
-// cross-origin, the first announcement can arrive before the host's load handler is listening.
-const announce=setInterval(()=>parent.postMessage(ready,'*'),120);
-setTimeout(()=>clearInterval(announce),15000);
-addEventListener('message',(event)=>{
-  if(event.source===parent){
-    const message=event.data;
-    if(message?.method==='ui/notifications/sandbox-resource-ready'){
-      clearInterval(announce);
-      if(inner)return;
-      inner=document.createElement('iframe');
-      inner.setAttribute('sandbox',message.params?.sandbox||'allow-scripts');
-      inner.setAttribute('referrerpolicy','no-referrer');
-      inner.srcdoc=String(message.params?.html||'');
-      document.body.replaceChildren(inner);
-      return;
-    }
-    inner?.contentWindow?.postMessage(message,'*');
-  } else if(inner && event.source===inner.contentWindow) {
-    parent.postMessage(event.data,'*');
-  }
-});
-parent.postMessage(ready,'*');
-</script>`;
-/**
- * The sandbox document's own CSP. `sandbox allow-scripts` forces an opaque origin server-side even
- * if a future embedder frames the URL without a sandbox attribute (the document can never read
- * service cookies or storage); inline script/style must be allowed because the relay script and the
- * inner widget document's injected bridge are inline by design; everything else stays closed —
- * widget data flows only over the postMessage bridge, never direct fetch.
- */
-const SANDBOX_CSP = "sandbox allow-scripts; default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src https: data: blob:; font-src https: data:; frame-src about:; form-action 'none'; base-uri 'none'; frame-ancestors *";
-/** Serve the static, secret-free sandbox document. GET-only; cacheable despite the no-store baseline. */
-export function handleAssistantSandbox(req, res) {
+import { ASSISTANT_SANDBOX_DOCUMENT, resolveAssistantSandboxResponsePolicy, } from '@noodle-borg/assistant-gateway/portable';
+/** Serve the static, secret-free sandbox relay and apply its validated CSP before writing the body. */
+export function handleAssistantSandbox(req, res, options = {}) {
     if (req.method !== 'GET') {
         res.statusCode = 405;
         res.setHeader('Allow', 'GET');
         res.end();
         return;
     }
+    const policy = resolveAssistantSandboxResponsePolicy(req.url ?? '/', options.isolatedOrigin === true);
+    res.setHeader('Content-Security-Policy', policy.contentSecurityPolicy);
+    if (!policy.ok) {
+        res.statusCode = 400;
+        res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+        res.setHeader('Cache-Control', 'no-store');
+        res.end('Invalid sandbox policy');
+        return;
+    }
     res.statusCode = 200;
     res.setHeader('Content-Type', 'text/html; charset=utf-8');
-    res.setHeader('Content-Security-Policy', SANDBOX_CSP);
     res.setHeader('Cache-Control', 'public, max-age=300');
     res.end(ASSISTANT_SANDBOX_DOCUMENT);
 }

package/node_modules/@noodle-borg/service/dist/routes/assistant-session-target.js CHANGED Viewed

@@ -1,23 +1,49 @@
-import { projectArtifactForSurface, publicSurfaceOf, } from '@noodle-borg/assistant-gateway/portable';
+import { authenticatedSurfaceOf, projectArtifactForSurface, publicSurfaceOf, surfaceBindingForOrigin, } from '@noodle-borg/assistant-gateway/portable';
 export async function sessionScopedTarget(registry, session) {
     const target = await registry.get(session.deploymentId);
     if (!target)
         return undefined;
-    // Keyed on the embed id, not `identityKind`: after elevation a signed-in visitor on a mixed surface
-    // keeps the surface that admitted them, and should keep its projection with it.
-    if (session.publicEmbedId === undefined)
+    const assistant = target.served.artifact.server.assistant;
+    const bound = session.boundSurface ?? deriveLegacyBinding(assistant, session);
+    if (bound === 'pre-surfaces')
         return target;
-    const surface = publicSurfaceOf(target.served.artifact.server.assistant);
-    // Fail closed. A rollback to an artifact with no public surface must end the session's reach, never
-    // hand it the unprojected server.
+    // Fail closed: an origin no surface owns must never widen to the whole server.
+    if (bound === 'unowned')
+        return undefined;
+    // Fail closed on a vanished surface. A rollback to an artifact without the bound surface must end the
+    // session's reach, never hand it the unprojected server.
+    if (bound === 'authenticated') {
+        const surface = authenticatedSurfaceOf(assistant);
+        if (surface === undefined)
+            return undefined;
+        // An omitted allowlist on an authenticated surface is the authored whole-server intent, so the
+        // exact binding still holds (instructions, budgets, attribution) without narrowing capabilities.
+        if (surface.capabilities === undefined)
+            return target;
+        return projected(target, surface.capabilities);
+    }
+    const surface = publicSurfaceOf(assistant);
     if (surface === undefined)
         return undefined;
+    return projected(target, surface.capabilities);
+}
+function projected(target, capabilities) {
     return {
         ...target,
         served: {
             ...target.served,
-            artifact: projectArtifactForSurface(target.served.artifact, surface.capabilities),
+            artifact: projectArtifactForSurface(target.served.artifact, capabilities),
         },
     };
 }
+/**
+ * A record minted before `boundSurface` existed: the embed id marks the public surface; otherwise the
+ * session's origin selects the owning surface on the pinned deployment. `pre-surfaces` means the whole
+ * server on that released artifact shape; `unowned` fails closed above.
+ */
+function deriveLegacyBinding(assistant, session) {
+    if (session.publicEmbedId !== undefined)
+        return 'public';
+    return surfaceBindingForOrigin(assistant, session.origin).kind;
+}
 //# sourceMappingURL=assistant-session-target.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-transcript.js ADDED Viewed

@@ -0,0 +1,27 @@
+import { visibleTranscript } from '@noodle-borg/assistant-gateway/portable';
+import { assistantTranscriptResponseSchema } from '@noodle-borg/wire-contracts';
+import { sendJson } from '../http-util.js';
+import { applyBrowserCors, authenticateSession } from './assistant-route-http.js';
+/**
+ * The bounded visible-transcript read (ADR 0141/0201 amendments 2026-08-26), in its own module for
+ * the same reason `assistant-elevation.ts` is: `assistant.ts` is at its size limit, and this is a
+ * different responsibility from running a turn.
+ *
+ * POST, deliberately: every other session route is a POST, so the existing preflight's
+ * `POST, OPTIONS` shape covers it without widening allow-methods. Auth is exactly the shared
+ * session gate — current token, pinned origin — so a stale pre-elevation token cannot read, by
+ * construction. A read spends no turn budget: admission binds metered work (ADR 0201 decision 8),
+ * and this is a projection over state that already exists and already expires with the session.
+ */
+export async function handleAssistantTranscript(req, res, deps) {
+    const session = await authenticateSession(req, res, deps);
+    if (!session)
+        return;
+    applyBrowserCors(req, res, session.origin);
+    const body = { entries: visibleTranscript(session.history) };
+    // Parse before sending, like the session exchange: a contract break fails loudly here rather than
+    // stranding deployed widgets (ADR 0151).
+    assistantTranscriptResponseSchema.parse(body);
+    return sendJson(res, 200, body);
+}
+//# sourceMappingURL=assistant-transcript.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { clientAddressBucket, } from '@noodle-borg/admission-limits/portable';
-import { ASSISTANT_SESSION_IDLE_MS, dispatchAssistantTool, parseAssistantContextPreferences, parseAssistantCustomerRouting, resumeTurnMessage, shouldAutoResume, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { ASSISTANT_SESSION_IDLE_MS, dispatchAssistantTool, parseAssistantContextPreferences, parseAssistantCustomerRouting, resumeTurnMessage, resumeUnavailableMessage, shouldAutoResume, surfaceBindingForOrigin, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { canonicalizeAuthorizationClaimValues } from '@noodle-borg/auth';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { tenantMcpUrl } from '@noodle-borg/module';
@@ -14,7 +14,7 @@ import { assistantBrowserConfiguration } from './assistant-configuration.js';
 import { elevateAssistantSession } from './assistant-elevation.js';
 import { executeAssistantKnowledgeSearch, findAssistantKnowledgeComponent, resolveAssistantKnowledge, } from './assistant-knowledge.js';
 import { refusePublicTurn } from './assistant-public-turn.js';
-import { applyBrowserCors, authenticateSession, handleAssistantPreflight, now, } from './assistant-route-http.js';
+import { applyBrowserCors, assistantSessionEndpoints, authenticateSession, handleAssistantPreflight, now, } from './assistant-route-http.js';
 import { sessionScopedTarget } from './assistant-session-target.js';
 import { authorizeControlPlane } from './control-plane.js';
 export { applyBrowserCors, authenticateSession, handleAssistantPreflight, now };
@@ -42,108 +42,6 @@ export async function handleConsoleApprovalNonce(req, res, deps) {
     const consumed = await deps.store.consumeConsoleApprovalNonce(nonce, identity.subject, expiry, current);
     return sendJson(res, consumed ? 201 : 409, consumed ? { ok: true } : { ok: false, error: 'already_used_or_expired' });
 }
-export async function handleAssistantClients(req, res, tenant, id, action, deps) {
-    const identity = await authorizeControlPlane(req, res, deps.gate, { requireIdentity: false });
-    if (identity === false)
-        return;
-    if (identity && !identity.superAdmin) {
-        const member = await deps.controlPlane.isOrgMember({
-            org: tenant.org,
-            subject: identity.subject,
-        });
-        if (!member)
-            return sendForbidden(res, 'forbidden');
-    }
-    if (action === 'collection' && req.method === 'GET') {
-        const clients = await deps.store.listClients(tenant);
-        return sendJson(res, 200, {
-            ok: true,
-            clients: clients.map(publicClient),
-        });
-    }
-    if (action === 'collection' && req.method === 'POST') {
-        const body = await readJsonBody(req, deps.maxBody);
-        if (!body.ok)
-            return sendJson(res, body.status, { error: body.error });
-        const name = body.value.name;
-        if (typeof name !== 'string' || name.trim().length < 1 || name.length > 80) {
-            return sendJson(res, 400, { error: '"name" must be a non-empty string' });
-        }
-        const target = await deps.registry.getActiveByTenant(tenant);
-        const assistant = target?.served.artifact.server.assistant;
-        if (!target?.deploymentId || !assistant)
-            return sendJson(res, 409, { error: 'deployment has no embedded assistant' });
-        const created = await deps.store.createClient({
-            name: name.trim(),
-            tenant,
-            deploymentId: target.deploymentId,
-            allowedOrigins: assistant.allowedOrigins,
-            now: now(deps),
-        });
-        await deps.audit.emit({
-            eventType: 'assistant.client.created',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            deploymentId: target.deploymentId,
-            decision: 'allow',
-            status: 201,
-            ...(identity ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email ? { actorEmail: identity.email } : {}),
-            details: { clientId: created.client.id, name: created.client.name },
-        });
-        return sendJson(res, 201, {
-            ok: true,
-            ...publicClient(created.client),
-            clientSecret: created.secret,
-        });
-    }
-    if (!id)
-        return sendJson(res, 404, { error: 'not found' });
-    const owned = (await deps.store.listClients(tenant)).some((client) => client.id === id);
-    if (!owned)
-        return sendJson(res, 404, { error: 'not found' });
-    if (action === 'rotate' && req.method === 'POST') {
-        const rotated = await deps.store.rotateClient(id, now(deps));
-        if (!rotated)
-            return sendJson(res, 404, { error: 'not found' });
-        await deps.audit.emit({
-            eventType: 'assistant.client.rotated',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            deploymentId: rotated.client.deploymentId,
-            decision: 'allow',
-            status: 200,
-            ...(identity ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email ? { actorEmail: identity.email } : {}),
-            details: { clientId: rotated.client.id },
-        });
-        return sendJson(res, 200, {
-            ok: true,
-            ...publicClient(rotated.client),
-            clientSecret: rotated.secret,
-        });
-    }
-    if (action === 'item' && req.method === 'DELETE') {
-        await deps.store.revokeClient(id, now(deps));
-        await deps.audit.emit({
-            eventType: 'assistant.client.revoked',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            decision: 'allow',
-            status: 204,
-            ...(identity ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email ? { actorEmail: identity.email } : {}),
-            details: { clientId: id },
-        });
-        res.statusCode = 204;
-        res.end();
-        return;
-    }
-    sendJson(res, 405, { error: 'method not allowed' });
-}
 export async function handleAssistantSession(req, res, deps) {
     const usageStartedAt = performance.now();
     const credentials = basicCredentials(req);
@@ -173,6 +71,13 @@ export async function handleAssistantSession(req, res, deps) {
     if (!assistant.allowedOrigins.includes(parsed.origin)) {
         return sendForbidden(res, 'origin is not allowed');
     }
+    // Every session binds one exact authored surface (ADR 0201): the origin selects it, and an origin no
+    // surface owns is refused rather than admitted against the deployment-wide union. A pre-surfaces
+    // artifact has no surfaces to select from; its union remains its whole released contract.
+    const surfaceBinding = surfaceBindingForOrigin(assistant, parsed.origin);
+    if (surfaceBinding.kind === 'unowned') {
+        return sendForbidden(res, 'origin is not allowed');
+    }
     const customerRouting = parseAssistantCustomerRouting(target.served.artifact.customerEndpoints, parsed.routing);
     if (!customerRouting.ok) {
         return sendJson(res, 400, {
@@ -229,18 +134,15 @@ export async function handleAssistantSession(req, res, deps) {
             client,
             resume: shouldAutoResume(parsed.resume),
             origin: parsed.origin,
+            // The conversation lands on the surface owning the (validated) landing origin: signing in on
+            // the app surface continues under its projection (ADR 0201 amendment 2026-08-26).
+            ...(surfaceBinding.kind === 'pre-surfaces' ? {} : { boundSurface: surfaceBinding.kind }),
             ...(customerRouting.customerRouting
                 ? { customerRouting: customerRouting.customerRouting }
                 : {}),
             caller,
             configuration,
-            endpoints: {
-                turns: `${deps.serviceBase(req)}/v1/assistant/turns`,
-                toolConfirmations: `${deps.serviceBase(req)}/v1/assistant/tool-confirmations`,
-                interactions: `${deps.serviceBase(req)}/v1/assistant/interactions`,
-                apps: `${deps.serviceBase(req)}/v1/assistant/apps`,
-                sandbox: `${deps.serviceBase(req)}/v1/assistant/sandbox`,
-            },
+            endpoints: assistantSessionEndpoints(deps.serviceBase(req), deps.sandboxBase?.(req)),
         });
     }
     const session = await deps.store.createSession({
@@ -249,6 +151,7 @@ export async function handleAssistantSession(req, res, deps) {
         deploymentId: target.deploymentId,
         modelSource: assistant.model.kind === 'noodle-managed' ? 'noodle-managed' : 'operator',
         origin: parsed.origin,
+        ...(surfaceBinding.kind === 'pre-surfaces' ? {} : { boundSurface: surfaceBinding.kind }),
         ...(customerRouting.customerRouting
             ? { customerRouting: customerRouting.customerRouting }
             : {}),
@@ -263,13 +166,7 @@ export async function handleAssistantSession(req, res, deps) {
     const sessionBody = {
         token: session.token,
         expiresAt: session.session.expiresAt,
-        endpoints: {
-            turns: `${deps.serviceBase(req)}/v1/assistant/turns`,
-            toolConfirmations: `${deps.serviceBase(req)}/v1/assistant/tool-confirmations`,
-            interactions: `${deps.serviceBase(req)}/v1/assistant/interactions`,
-            apps: `${deps.serviceBase(req)}/v1/assistant/apps`,
-            sandbox: `${deps.serviceBase(req)}/v1/assistant/sandbox`,
-        },
+        endpoints: assistantSessionEndpoints(deps.serviceBase(req), deps.sandboxBase?.(req)),
         ...(configuration ? { configuration } : {}),
     };
     // Every published @noodleseed/assistant widget consumes this shape; parse (don't just test)
@@ -293,6 +190,7 @@ export async function handleAssistantTurn(req, res, deps) {
     const addressBucket = clientAddressBucket(typeof req.headers['x-forwarded-for'] === 'string' ? req.headers['x-forwarded-for'] : undefined);
     let turn;
     let message;
+    let resumedTool;
     if (isRecord(body.value) && 'resume' in body.value) {
         // The one-shot post-sign-in resume (issue #1177): no user text, the pending intent is server
         // state. Admission runs FIRST so a refused resume stays armed for a retry; the consume is a
@@ -313,6 +211,7 @@ export async function handleAssistantTurn(req, res, deps) {
             });
         }
         message = resumeTurnMessage(pending.tool);
+        resumedTool = pending.tool;
         await deps.audit.emit({
             eventType: 'assistant.session.resumed',
             org: session.tenant.org,
@@ -361,6 +260,12 @@ export async function handleAssistantTurn(req, res, deps) {
     const target = await sessionScopedTarget(deps.registry, session);
     if (!target)
         return sendJson(res, 409, { error: 'assistant deployment is unavailable' });
+    if (resumedTool !== undefined &&
+        !target.served.artifact.tools.some((tool) => tool.name === resumedTool)) {
+        // The elevation landed on a surface whose projection does not offer the intercepted tool: fail
+        // closed to an honest explanation instead of asking the model to call a tool it cannot see.
+        message = resumeUnavailableMessage(resumedTool);
+    }
     const clientContext = turn?.clientContext === undefined
         ? undefined
         : parseAssistantContextPreferences(turn.clientContext);
@@ -396,8 +301,11 @@ export async function handleAssistantTurn(req, res, deps) {
             .map((event) => String(event.data.delta ?? ''))
             .join('');
         await deps.store.appendHistory(session.id, [
-            { role: 'user', content: message.trim() },
-            ...(assistantContent ? [{ role: 'assistant', content: assistantContent }] : []),
+            // A resume turn's user row is the [platform] prompt the visitor never typed or saw.
+            { role: 'user', content: message.trim(), kind: turn ? 'visible' : 'narration' },
+            ...(assistantContent
+                ? [{ role: 'assistant', content: assistantContent, kind: 'visible' }]
+                : []),
         ]);
     }
     catch {
@@ -559,14 +467,4 @@ function isContext(value) {
                 typeof item === 'boolean' ||
                 (typeof item === 'string' && item.length <= 2_000))));
 }
-function publicClient(client) {
-    return {
-        id: client.id,
-        name: client.name,
-        createdAt: client.createdAt,
-        // Audit data only: sessions follow the tenant's active deployment, not this snapshot.
-        createdAgainstDeploymentId: client.deploymentId,
-        ...(client.revokedAt ? { revokedAt: client.revokedAt } : {}),
-    };
-}
 //# sourceMappingURL=assistant.js.map

package/node_modules/@noodle-borg/service/dist/routes/config-values.js CHANGED Viewed

@@ -94,7 +94,7 @@ function developerConfigAccess(grants, controlPlane, ref, method) {
             controlPlane,
             org: ref.scope.org,
             capability: method === 'GET' ? 'cloud:read' : 'config:write',
-            resourcePath: DEVELOPER_CLI_PATH,
+            resourcePaths: new Set([DEVELOPER_CLI_PATH]),
         },
     };
 }

package/node_modules/@noodle-borg/service/dist/routes/control-plane.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { cspFaultsInManifest } from '@noodle-borg/compiler';
 import { ensurePersonalWorkspace } from '@noodle-borg/control-plane/portable';
-import { DEVELOPER_CLI_PATH } from '@noodle-borg/developer-mcp';
+import { DEVELOPER_ASSISTANT_PATH, DEVELOPER_CLI_PATH, } from '@noodle-borg/developer-mcp';
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { noopLogger } from '@noodle-borg/transport-http';
 import { deployRequestSchema, formatWireError, } from '@noodle-borg/wire-contracts';
@@ -504,9 +504,15 @@ export async function handleDeploymentStatus(req, res, registry, gate, controlPl
     }
 }
 export function developerGrantRouteAccess(grants, capability) {
+    // Control-plane routes serve the CLI resource and the assistant resource (ADR 0218); the grant's
+    // own capability ceiling — never this set — decides what each may actually do.
     return grants === undefined
         ? undefined
-        : { grants, capability, resourcePath: DEVELOPER_CLI_PATH };
+        : {
+            grants,
+            capability,
+            resourcePaths: new Set([DEVELOPER_CLI_PATH, DEVELOPER_ASSISTANT_PATH]),
+        };
 }
 async function authorizeHumanDeploy(req, res, options, gate, controlPlane, org) {
     const developerAccess = developerGrantAccess(options.developerGrantStore, controlPlane, org, 'deployments:write');

package/node_modules/@noodle-borg/service/dist/service.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { InMemoryAssistantStore } from '@noodle-borg/assistant-gateway/portable';
+import { InMemoryAssistantStore, isAssistantSandboxHost, validateAssistantSandboxBaseUrl, } from '@noodle-borg/assistant-gateway/portable';
 import { allowAllGate, InMemoryControlPlaneStore } from '@noodle-borg/control-plane/portable';
 import { dispatchKnowledgeRequest } from '@noodle-borg/knowledge-operations/portable';
 import { OPENAI_APPS_CHALLENGE_PATH } from '@noodle-borg/module';
@@ -50,6 +50,9 @@ const DEFAULT_MAX_BODY = 1 << 20;
 const DEFAULT_MAX_DEPLOY_BODY = 32 * 1024 * 1024;
 /** The combined service listener: tenant-scoped deploy management plus the multi-tenant MCP router. */
 export function createServiceHandler(registry, options = {}) {
+    const assistantSandboxBaseUrl = options.assistantSandboxBaseUrl === undefined
+        ? undefined
+        : validateAssistantSandboxBaseUrl(options.assistantSandboxBaseUrl, options.publicBaseUrl);
     const logger = options.logger ?? noopLogger;
     const tls = options.tls ?? {};
     const buildInfo = options.buildInfo ?? resolveBuildInfo();
@@ -155,6 +158,14 @@ export function createServiceHandler(registry, options = {}) {
     };
     return (req, res) => {
         const url = new URL(req.url ?? '/', 'http://localhost');
+        const onAssistantSandboxHost = isAssistantSandboxHost(req.headers.host, assistantSandboxBaseUrl);
+        if (onAssistantSandboxHost && url.pathname !== '/v1/assistant/sandbox') {
+            applySecurityHeaders(res, tls);
+            if (enforceHttps(req, res, tls))
+                return;
+            sendJson(res, 404, { error: 'not found' });
+            return;
+        }
         // Liveness/readiness probes: un-gated and **not** HTTPS-enforced — Cloud Run's internal probe is plain
         // HTTP, so enforcing HTTPS here would `426` the probe and the revision would never go healthy (ADR 0034).
         // `/healthz` is a pure liveness 200 (no store touch); `/readyz` reflects the injected readiness probe.
@@ -250,6 +261,9 @@ export function createServiceHandler(registry, options = {}) {
             audit: activeAudit,
             maxBody,
             serviceBase: (request) => options.publicBaseUrl ?? baseFromRequest(request, tls),
+            ...(assistantSandboxBaseUrl === undefined
+                ? {}
+                : { sandboxBase: () => assistantSandboxBaseUrl }),
             ...(options.assistantModelFetch !== undefined
                 ? { modelFetch: options.assistantModelFetch }
                 : {}),

package/node_modules/@noodle-borg/service/package.json CHANGED Viewed

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.84.1",
+    "@noodle-borg/agent-kit": "0.85.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/wire-contracts/dist/assistant.d.ts CHANGED Viewed

@@ -20,6 +20,7 @@ export declare const assistantSessionResponseSchema: z.ZodObject<{
         interactions: z.ZodOptional<z.ZodURL>;
         apps: z.ZodOptional<z.ZodURL>;
         sandbox: z.ZodOptional<z.ZodURL>;
+        transcript: z.ZodOptional<z.ZodURL>;
     }, z.core.$strip>;
     configuration: z.ZodOptional<z.ZodObject<{
         branding: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -30,6 +31,22 @@ export declare const assistantSessionResponseSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type AssistantSessionResponse = z.infer<typeof assistantSessionResponseSchema>;
+/**
+ * The bounded visible transcript (ADR 0141/0201 amendments 2026-08-26): only rows that actually
+ * appeared in the panel — never tool internals, tickets, or model-facing scaffolding. Bounded by the
+ * session history window (40 messages); a read spends no turn budget. Strict, because the service
+ * parses its own response before sending, like the session exchange.
+ */
+export declare const assistantTranscriptResponseSchema: z.ZodObject<{
+    entries: z.ZodArray<z.ZodObject<{
+        role: z.ZodEnum<{
+            assistant: "assistant";
+            user: "user";
+        }>;
+        text: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AssistantTranscriptResponse = z.infer<typeof assistantTranscriptResponseSchema>;
 /** MCP-Apps-shaped, author-selected renderer summary included on one assistant turn. */
 export declare const assistantModelContextUpdateSchema: z.ZodObject<{
     content: z.ZodOptional<z.ZodArray<z.ZodObject<{

package/node_modules/@noodle-borg/wire-contracts/dist/assistant.js CHANGED Viewed

@@ -42,6 +42,13 @@ export const assistantSessionResponseSchema = z.object({
          * published client falls back to the srcdoc proxy.
          */
         sandbox: z.url().optional(),
+        /**
+         * Additive bounded visible-transcript endpoint (ADR 0141/0201 amendments 2026-08-26): a
+         * session-token-authenticated POST returning what the panel may repaint after a full-page
+         * navigation — the sign-in redirect above all. Absent on older services; the widget then
+         * starts visually fresh exactly as before.
+         */
+        transcript: z.url().optional(),
     }),
     configuration: assistantSessionConfigurationSchema.optional(),
     /**
@@ -51,6 +58,24 @@ export const assistantSessionResponseSchema = z.object({
      */
     resume: z.object({ tool: z.string().min(1) }).optional(),
 });
+/**
+ * The bounded visible transcript (ADR 0141/0201 amendments 2026-08-26): only rows that actually
+ * appeared in the panel — never tool internals, tickets, or model-facing scaffolding. Bounded by the
+ * session history window (40 messages); a read spends no turn budget. Strict, because the service
+ * parses its own response before sending, like the session exchange.
+ */
+export const assistantTranscriptResponseSchema = z
+    .object({
+    entries: z
+        .array(z
+        .object({
+        role: z.enum(['user', 'assistant']),
+        text: z.string(),
+    })
+        .strict())
+        .max(40),
+})
+    .strict();
 const assistantModelContentPartSchema = z
     .object({ type: z.literal('text'), text: z.string() })
     .strict();

package/node_modules/@noodleseed/assistant/README.md CHANGED Viewed

@@ -35,8 +35,8 @@ troubleshooting) lives at <https://docs.noodleseed.dev/guides/embedded-assistant
 the server itself is `@noodleseed/one` (`npm install -g @noodleseed/one`).
 If your page sends a `Content-Security-Policy`, allow the Noodle service origin in `connect-src` (turns and
-event streams) **and** `frame-src` (app widgets render inside a hosted sandbox document served from the
-service origin, `endpoints.sandbox`, so your `script-src` can stay strict). Details are in the guide's
+event streams) and the exact session-advertised `endpoints.sandbox` origin in `frame-src` (it may be a
+dedicated sandbox origin, so your `script-src` can stay strict). Details are in the guide's
 "Content-Security-Policy on your page" section.
 ## Quick start
@@ -410,13 +410,8 @@ import "@noodleseed/assistant/app-view";
 </template>
 ```
-Configure Vue's `isCustomElement` for `noodle-app-view`. Angular uses the same element with `[client]`,
-`[view]`, and `[theme]` property bindings. Do not serialize `client` or `view` into attributes.
-`<noodle-app-view>` is the canonical host; `NoodleAppView` delegates to it. Both use the
-service-advertised sandbox URL, route App calls through the supplied client, publish theme changes without
-replacing the iframe, and request standard teardown on semantic replacement, disconnect, or an App teardown
-request.
+Framework setup, lifecycle ownership, sandbox/CSP behavior, and staged diagnostics are owned by the
+[Bring your own UI guide](https://docs.noodleseed.dev/docs/guides/bring-your-own-ui).
 The App document owns its action intent: it calls standard `tools/call` after connecting and never relies on
 native form navigation. If that call needs input or confirmation, the same `client` publishes the normal

package/node_modules/@noodleseed/assistant/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.24.0",
+  "version": "1.25.0",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {