@noodleseed/one 0.141.1 → 0.142.0

package/node_modules/@noodle-borg/service/dist/routes/assistant-agent.js

@@ -1,12 +1,10 @@
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
 import { requestModelCompletion, } from '@noodle-borg/assistant-gateway/model-runtime';
-import { assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, authenticatedSurfaceOf, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, assistantViewAvailableData, authenticatedSurfaceOf, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, toolTouchesDelegatedAuth, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { guardedFetch } from '@noodle-borg/connector-http';
 import { evaluateToolAuthorization } from '@noodle-borg/protocol';
 import { executeTool } from '@noodle-borg/runtime';
-import { toolTouchesDelegatedAuth } from '../assistant-delegated-projection.js';
-import { assistantViewAvailableData } from '../assistant-view-availability.js';
 import { invocationContextSystemMessages } from '../invocation-context.js';
 import { interceptForElevation, offersSignIn } from './assistant-elevation.js';
 import { assistantKnowledgeModelTools, executeAssistantKnowledgeSearch, findAssistantKnowledgeComponent, KNOWLEDGE_CITATION_GUIDANCE, resolveAssistantKnowledge, } from './assistant-knowledge.js';

package/node_modules/@noodle-borg/service/dist/routes/assistant-appearance.js

@@ -0,0 +1,104 @@
+import { assistantAppearanceOverrideSchema, assistantBrowserConfiguration, resolveAssistantAppearanceConfiguration, } from '@noodle-borg/assistant-gateway/portable';
+import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { now } from './assistant-route-http.js';
+import { authorizeControlPlane } from './control-plane.js';
+export async function handleAssistantAppearance(req, res, tenant, deps) {
+    const store = deps.appearance;
+    if (store === undefined)
+        return sendJson(res, 503, { error: 'assistant appearance is unavailable' });
+    const identity = await authorizeControlPlane(req, res, deps.gate, { requireIdentity: false });
+    if (identity === false)
+        return;
+    if (identity && !identity.superAdmin) {
+        const member = await deps.controlPlane.isOrgMember({
+            org: tenant.org,
+            subject: identity.subject,
+        });
+        if (!member)
+            return sendForbidden(res, 'forbidden');
+    }
+    if (req.method === 'GET')
+        return respond(res, tenant, deps);
+    const expectedRevision = parseExpectedRevision(req.headers['if-match']);
+    if (expectedRevision === undefined) {
+        return sendJson(res, req.headers['if-match'] === undefined ? 428 : 400, {
+            error: req.headers['if-match'] === undefined ? 'If-Match is required' : 'invalid If-Match',
+        });
+    }
+    let override;
+    if (req.method === 'PUT') {
+        const body = await readJsonBody(req, deps.maxBody);
+        if (!body.ok)
+            return sendJson(res, body.status, { error: body.error });
+        const parsed = assistantAppearanceOverrideSchema.safeParse(body.value);
+        if (!parsed.success)
+            return sendJson(res, 400, { error: 'invalid assistant appearance' });
+        override = parsed.data;
+    }
+    else if (req.method !== 'DELETE') {
+        return sendJson(res, 405, { error: 'method not allowed' });
+    }
+    const updated = await store.replace({
+        tenant,
+        expectedRevision,
+        override,
+        updatedAt: now(deps),
+        updatedBy: identity?.subject ?? 'local-operator',
+    });
+    if (!updated.ok) {
+        return sendJson(res, 409, {
+            error: 'assistant appearance revision conflict',
+            currentRevision: updated.currentRevision,
+        });
+    }
+    const target = await deps.registry.getActiveByTenant(tenant);
+    await deps.audit.emit({
+        eventType: updated.record.override === undefined
+            ? 'assistant.appearance.reset'
+            : 'assistant.appearance.updated',
+        org: tenant.org,
+        app: tenant.app,
+        env: tenant.env,
+        ...(target?.deploymentId ? { deploymentId: target.deploymentId } : {}),
+        decision: 'allow',
+        status: 200,
+        ...(identity ? { actorSubject: identity.subject } : {}),
+        ...(identity?.email ? { actorEmail: identity.email } : {}),
+        details: {
+            revision: updated.record.revision,
+            hasOverride: updated.record.override !== undefined,
+        },
+    });
+    return respond(res, tenant, deps, updated.record, target);
+}
+async function respond(res, tenant, deps, knownRecord, knownTarget) {
+    const target = knownTarget ?? (await deps.registry.getActiveByTenant(tenant));
+    const developer = target
+        ? assistantBrowserConfiguration(target.served.artifact.server)
+        : undefined;
+    const record = knownRecord ?? (await deps.appearance?.get(tenant));
+    const resolution = resolveAssistantAppearanceConfiguration(developer, record?.override);
+    const revision = record?.revision ?? 0;
+    res.setHeader('etag', `"${revision}"`);
+    return sendJson(res, 200, {
+        ok: true,
+        assistantEnabled: target?.served.artifact.server.assistant !== undefined,
+        revision,
+        fallback: resolution.fallback,
+        developer: developer ?? null,
+        override: record?.override ?? null,
+        effective: resolution.effective ?? null,
+        provenance: resolution.provenance,
+        ...(record ? { updatedAt: record.updatedAt.toISOString(), updatedBy: record.updatedBy } : {}),
+    });
+}
+function parseExpectedRevision(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const match = /^"(0|[1-9][0-9]*)"$/.exec(value);
+    if (!match?.[1])
+        return undefined;
+    const revision = Number(match[1]);
+    return Number.isSafeInteger(revision) ? revision : undefined;
+}
+//# sourceMappingURL=assistant-appearance.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-dispatch.js

@@ -1,10 +1,11 @@
-import { isAssistantSandboxHost, } from '@noodle-borg/assistant-gateway/portable';
 import { handleAssistantAppRequest, handleAssistantPreflight, handleAssistantSession, handleAssistantTurn, handleConsoleApprovalNonce, } from './assistant.js';
+import { handleAssistantAppearance } from './assistant-appearance.js';
 import { handleAssistantClients } from './assistant-clients.js';
 import { handleAssistantDoctor } from './assistant-doctor.js';
 import { handleAssistantEmbedScript } from './assistant-embed-script.js';
 import { handleAssistantEmbeds } from './assistant-embeds.js';
 import { handleAssistantConfirmation, handleAssistantInteraction, } from './assistant-interactions.js';
+import { handlePublicAssistantConfiguration } from './assistant-public-configuration.js';
 import { handlePublicAssistantSession } from './assistant-public-session.js';
 import { handleAssistantSandbox } from './assistant-sandbox.js';
 import { handleAssistantTranscript } from './assistant-transcript.js';
@@ -36,14 +37,24 @@ export function dispatchAssistantRoutes(req, res, url, deps) {
         deps.applySecurityHeaders(res, deps.tls);
         if (deps.enforceHttps(req, res, deps.tls))
             return true;
-        const sandboxBase = deps.sandboxBase?.(req);
-        const isolatedOrigin = isAssistantSandboxHost(req.headers.host, sandboxBase);
-        handleAssistantSandbox(req, res, { isolatedOrigin });
+        handleAssistantSandbox(req, res);
         return true;
     }
     if (url.pathname === '/v1/assistant/public-sessions' && req.method === 'POST') {
         return run(req, res, deps, () => handlePublicAssistantSession(req, res, deps));
     }
+    const publicConfigurationMatch = /^\/v1\/assistant\/public-configurations\/([^/]+)$/.exec(url.pathname);
+    if (publicConfigurationMatch) {
+        let embedId;
+        try {
+            embedId = decodeURIComponent(publicConfigurationMatch[1] ?? '');
+        }
+        catch {
+            deps.sendJson(res, 400, { error: 'invalid embed id' });
+            return true;
+        }
+        return run(req, res, deps, () => handlePublicAssistantConfiguration(req, res, embedId, deps));
+    }
     if (url.pathname === '/v1/assistant/sessions' && req.method === 'POST') {
         return run(req, res, deps, () => handleAssistantSession(req, res, deps));
     }
@@ -57,6 +68,15 @@ export function dispatchAssistantRoutes(req, res, url, deps) {
         return run(req, res, deps, () => handleAssistantTranscript(req, res, deps));
     }
     const doctorMatch = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/assistant\/doctor$/.exec(url.pathname);
+    const appearanceMatch = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/assistant\/appearance$/.exec(url.pathname);
+    if (appearanceMatch) {
+        const tenant = decodeTenant(appearanceMatch);
+        if (!tenant) {
+            deps.sendJson(res, 400, { error: 'invalid tenant path' });
+            return true;
+        }
+        return run(req, res, deps, () => handleAssistantAppearance(req, res, tenant, deps));
+    }
     if (doctorMatch) {
         const tenant = decodeTenant(doctorMatch);
         if (!tenant) {

package/node_modules/@noodle-borg/service/dist/routes/assistant-interaction-replay.js

@@ -1,5 +1,4 @@
-import { assistantInteractionTool, auditAssistantInteraction, } from '@noodle-borg/assistant-gateway/portable';
-import { assistantViewAvailableData } from '../assistant-view-availability.js';
+import { assistantInteractionTool, assistantViewAvailableData, auditAssistantInteraction, } from '@noodle-borg/assistant-gateway/portable';
 import { sendJson } from '../http-util.js';
 import { now } from './assistant.js';
 import { assistantInteractionScope } from './assistant-interaction-resolution.js';

package/node_modules/@noodle-borg/service/dist/routes/assistant-interactions.js

@@ -1,6 +1,5 @@
-import { AssistantInteractionCapacityError, assistantConfirmationReview, assistantConfirmationTransition, assistantInputTransition, assistantInteractionTool, assistantPreparedArgumentReview, assistantPreparedToolContinuation, assistantSafeOutput, assistantToolContinuation, auditAssistantInteraction, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { AssistantInteractionCapacityError, assistantConfirmationReview, assistantConfirmationTransition, assistantInputTransition, assistantInteractionTool, assistantPreparedArgumentReview, assistantPreparedToolContinuation, assistantSafeOutput, assistantToolContinuation, assistantViewAvailableData, auditAssistantInteraction, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { executePreparedTool, executeToolInteractive, resumeTool, resumeToolPreparation, } from '@noodle-borg/runtime';
-import { assistantViewAvailableData } from '../assistant-view-availability.js';
 import { readJsonBody, sendJson } from '../http-util.js';
 import { applyBrowserCors, authenticateSession, now, } from './assistant.js';
 import { replayOrConflict, writeUnknownOutcome } from './assistant-interaction-replay.js';

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-configuration.js

@@ -0,0 +1,41 @@
+import { authorizePublicConfiguration, effectiveAssistantBrowserConfiguration, publicEmbedTenant, publicSurfaceOf, } from '@noodle-borg/assistant-gateway/portable';
+import { sendJson } from '../http-util.js';
+import { applyBrowserCors } from './assistant-route-http.js';
+/** Browser-safe first paint for a public launcher; never mints a session or spends admission. */
+export async function handlePublicAssistantConfiguration(req, res, embedId, deps) {
+    if (req.method !== 'GET')
+        return sendJson(res, 405, { error: 'method not allowed' });
+    if (deps.publicEmbeds === undefined) {
+        return sendJson(res, 503, { error: 'public assistant surfaces are not enabled' });
+    }
+    const origin = typeof req.headers.origin === 'string' ? req.headers.origin : undefined;
+    const state = {};
+    const authorized = await authorizePublicConfiguration({ embedId, origin }, {
+        embeds: deps.publicEmbeds,
+        resolveActiveSurface: async (embed) => {
+            state.target = await deps.registry.getActiveByTenant(publicEmbedTenant(embed));
+            return state.target
+                ? publicSurfaceOf(state.target.served.artifact.server.assistant)
+                : undefined;
+        },
+    });
+    if (!authorized.ok) {
+        return sendJson(res, authorized.status, {
+            error: authorized.message,
+            code: authorized.code,
+        });
+    }
+    const target = state.target;
+    if (target === undefined) {
+        return sendJson(res, 409, { error: 'assistant deployment is unavailable' });
+    }
+    const resolved = await effectiveAssistantBrowserConfiguration(target.served.artifact.server, publicEmbedTenant(authorized.embed), deps.appearance);
+    applyBrowserCors(req, res, origin);
+    res.setHeader('cache-control', 'private, no-cache');
+    return sendJson(res, 200, {
+        ...(resolved.effective ? { configuration: resolved.effective } : {}),
+        fallback: resolved.fallback,
+        revision: resolved.record?.revision ?? 0,
+    });
+}
+//# sourceMappingURL=assistant-public-configuration.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-session.js

@@ -1,10 +1,9 @@
 import { randomBytes } from 'node:crypto';
 import { ADMISSION_DEFAULTS, clientAddressBucket } from '@noodle-borg/admission-limits/portable';
-import { mintPublicSession, publicSurfaceOf, } from '@noodle-borg/assistant-gateway/portable';
+import { effectiveAssistantBrowserConfiguration, mintPublicSession, publicEmbedTenant, publicSurfaceOf, } from '@noodle-borg/assistant-gateway/portable';
 import { assistantSessionUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
 import { assistantSessionResponseSchema } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendJson } from '../http-util.js';
-import { assistantBrowserConfiguration } from './assistant-configuration.js';
 import { applyBrowserCors, assistantSessionEndpoints, now } from './assistant-route-http.js';
 /**
  * The transport half of anonymous session minting. Every decision — which refusal, in which order, and
@@ -16,10 +15,6 @@ import { applyBrowserCors, assistantSessionEndpoints, now } from './assistant-ro
  * echoes the validated origin, and a refusal echoes nothing, so a page that is not on the allowlist
  * fails visibly instead of quietly receiving a usable token.
  */
-/** The embed record stores the tenant flat; the registry and session store want it shaped. */
-function tenantOf(embed) {
-    return { org: embed.org, app: embed.app, env: embed.env };
-}
 export async function handlePublicAssistantSession(req, res, deps) {
     const usageStartedAt = performance.now();
     const embeds = deps.publicEmbeds;
@@ -45,12 +40,12 @@ export async function handlePublicAssistantSession(req, res, deps) {
         embeds,
         counters,
         resolveActiveSurface: async (embed) => {
-            const target = await deps.registry.getActiveByTenant(tenantOf(embed));
+            const target = await deps.registry.getActiveByTenant(publicEmbedTenant(embed));
             if (!target?.deploymentId)
                 return undefined;
             if (target.served.artifact.server.assistant?.model.kind === 'noodle-managed') {
                 sponsoredBudget = (await deps.managedModelResolver?.resolve({
-                    tenant: tenantOf(embed),
+                    tenant: publicEmbedTenant(embed),
                     deploymentId: target.deploymentId,
                 }))?.publicAdmission;
             }
@@ -60,16 +55,16 @@ export async function handlePublicAssistantSession(req, res, deps) {
         },
         resolveBudgetBounds: async () => sponsoredBudget,
         createSession: async (input) => {
-            const target = await deps.registry.getActiveByTenant(tenantOf(input.embed));
+            const target = await deps.registry.getActiveByTenant(publicEmbedTenant(input.embed));
             if (!target?.deploymentId)
                 throw new Error('assistant deployment vanished mid-mint');
             const current = now(deps);
-            configuration = assistantBrowserConfiguration(target.served.artifact.server);
+            configuration = (await effectiveAssistantBrowserConfiguration(target.served.artifact.server, publicEmbedTenant(input.embed), deps.appearance)).effective;
             const created = await deps.store.createSession({
                 // A public surface has no client credential, so the embed id stands in as the minting
                 // authority. It is not a secret and nothing downstream may begin treating it as one.
                 clientId: input.embed.embedId,
-                tenant: tenantOf(input.embed),
+                tenant: publicEmbedTenant(input.embed),
                 deploymentId: target.deploymentId,
                 modelSource: target.served.artifact.server.assistant?.model.kind === 'noodle-managed'
                     ? 'noodle-managed'
@@ -98,7 +93,7 @@ export async function handlePublicAssistantSession(req, res, deps) {
     const sessionBody = {
         token: result.token,
         expiresAt: result.expiresAt,
-        endpoints: assistantSessionEndpoints(deps.serviceBase(req), deps.sandboxBase?.(req)),
+        endpoints: assistantSessionEndpoints(deps.serviceBase(req)),
         ...(configuration ? { configuration } : {}),
     };
     // Parse rather than trust: every published @noodleseed/assistant widget consumes this shape, and the

package/node_modules/@noodle-borg/service/dist/routes/assistant-route-http.js

@@ -48,13 +48,13 @@ export function now(deps) {
     return deps.clock?.() ?? new Date();
 }
 /** The one endpoint map every session mint returns; three mints, one source of truth. */
-export function assistantSessionEndpoints(base, sandboxBase = base) {
+export function assistantSessionEndpoints(base) {
     return {
         turns: `${base}/v1/assistant/turns`,
         toolConfirmations: `${base}/v1/assistant/tool-confirmations`,
         interactions: `${base}/v1/assistant/interactions`,
         apps: `${base}/v1/assistant/apps`,
-        sandbox: `${sandboxBase}/v1/assistant/sandbox`,
+        sandbox: `${base}/v1/assistant/sandbox`,
         transcript: `${base}/v1/assistant/transcript`,
     };
 }

package/node_modules/@noodle-borg/service/dist/routes/assistant-sandbox.js

@@ -1,23 +1,58 @@
-import { ASSISTANT_SANDBOX_DOCUMENT, resolveAssistantSandboxResponsePolicy, } from '@noodle-borg/assistant-gateway/portable';
-/** Serve the static, secret-free sandbox relay and apply its validated CSP before writing the body. */
-export function handleAssistantSandbox(req, res, options = {}) {
+/**
+ * Hosted widget sandbox document (ADR 0151 addendum). The embedded assistant renders MCP App
+ * widgets in a double iframe; when the outer frame is an `about:srcdoc` document it inherits the
+ * customer page's CSP, so a strict `script-src` silently blanks every widget. Serving this relay
+ * document from the service origin gives it — and the inner `srcdoc` widget document that inherits
+ * from it — a CSP the platform controls. The body is pinned byte-for-byte to
+ * `contract/v1/assistant-sandbox-document.html` and to the published client's srcdoc fallback; any
+ * relay-protocol change is a coordinated contract event, never a local edit.
+ */
+export const ASSISTANT_SANDBOX_DOCUMENT = `<!doctype html><meta charset="utf-8"><style>html,body,iframe{border:0;margin:0;width:100%;height:100%;overflow:hidden}body{background:transparent}</style><script>
+let inner;
+const ready={jsonrpc:'2.0',method:'ui/notifications/sandbox-proxy-ready',params:{}};
+// Re-announce until the host acknowledges with the resource: when this document is hosted
+// cross-origin, the first announcement can arrive before the host's load handler is listening.
+const announce=setInterval(()=>parent.postMessage(ready,'*'),120);
+setTimeout(()=>clearInterval(announce),15000);
+addEventListener('message',(event)=>{
+  if(event.source===parent){
+    const message=event.data;
+    if(message?.method==='ui/notifications/sandbox-resource-ready'){
+      clearInterval(announce);
+      if(inner)return;
+      inner=document.createElement('iframe');
+      inner.setAttribute('sandbox',message.params?.sandbox||'allow-scripts');
+      inner.setAttribute('referrerpolicy','no-referrer');
+      inner.srcdoc=String(message.params?.html||'');
+      document.body.replaceChildren(inner);
+      return;
+    }
+    inner?.contentWindow?.postMessage(message,'*');
+  } else if(inner && event.source===inner.contentWindow) {
+    parent.postMessage(event.data,'*');
+  }
+});
+parent.postMessage(ready,'*');
+</script>`;
+/**
+ * The sandbox document's own CSP. `sandbox allow-scripts` forces an opaque origin server-side even
+ * if a future embedder frames the URL without a sandbox attribute (the document can never read
+ * service cookies or storage); inline script/style must be allowed because the relay script and the
+ * inner widget document's injected bridge are inline by design; everything else stays closed —
+ * widget data flows only over the postMessage bridge, never direct fetch.
+ */
+const SANDBOX_CSP = "sandbox allow-scripts; default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src https: data: blob:; font-src https: data:; frame-src about:; form-action 'none'; base-uri 'none'; frame-ancestors *";
+/** Serve the static, secret-free sandbox document. GET-only; cacheable despite the no-store baseline. */
+export function handleAssistantSandbox(req, res) {
     if (req.method !== 'GET') {
         res.statusCode = 405;
         res.setHeader('Allow', 'GET');
         res.end();
         return;
     }
-    const policy = resolveAssistantSandboxResponsePolicy(req.url ?? '/', options.isolatedOrigin === true);
-    res.setHeader('Content-Security-Policy', policy.contentSecurityPolicy);
-    if (!policy.ok) {
-        res.statusCode = 400;
-        res.setHeader('Content-Type', 'text/plain; charset=utf-8');
-        res.setHeader('Cache-Control', 'no-store');
-        res.end('Invalid sandbox policy');
-        return;
-    }
     res.statusCode = 200;
     res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.setHeader('Content-Security-Policy', SANDBOX_CSP);
     res.setHeader('Cache-Control', 'public, max-age=300');
     res.end(ASSISTANT_SANDBOX_DOCUMENT);
 }

package/node_modules/@noodle-borg/service/dist/routes/assistant.js

@@ -1,5 +1,5 @@
 import { clientAddressBucket, } from '@noodle-borg/admission-limits/portable';
-import { ASSISTANT_SESSION_IDLE_MS, dispatchAssistantTool, parseAssistantContextPreferences, parseAssistantCustomerRouting, resumeTurnMessage, resumeUnavailableMessage, shouldAutoResume, surfaceBindingForOrigin, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { ASSISTANT_SESSION_IDLE_MS, dispatchAssistantTool, effectiveAssistantBrowserConfiguration, parseAssistantContextPreferences, parseAssistantCustomerRouting, resumeTurnMessage, resumeUnavailableMessage, shouldAutoResume, surfaceBindingForOrigin, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { canonicalizeAuthorizationClaimValues } from '@noodle-borg/auth';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { tenantMcpUrl } from '@noodle-borg/module';
@@ -10,7 +10,6 @@ import { assistantMessageTurnRequestSchema, assistantResumeTurnRequestSchema, as
 import { readJsonBody, sendForbidden, sendJson, sendUnauthorized } from '../http-util.js';
 import { resolveInvocationContextSnapshot } from '../invocation-context.js';
 import { createAssistantTurnStats, runAgentTurn } from './assistant-agent.js';
-import { assistantBrowserConfiguration } from './assistant-configuration.js';
 import { elevateAssistantSession } from './assistant-elevation.js';
 import { executeAssistantKnowledgeSearch, findAssistantKnowledgeComponent, resolveAssistantKnowledge, } from './assistant-knowledge.js';
 import { refusePublicTurn } from './assistant-public-turn.js';
@@ -100,7 +99,7 @@ export async function handleAssistantSession(req, res, deps) {
     const declaredClaims = assistant.sessionClaims ?? {};
     const claims = Object.fromEntries(Object.entries(isVerifiedClaims(parsed.claims) ? parsed.claims : {}).filter(([key]) => key in declaredClaims));
     const current = now(deps);
-    const configuration = assistantBrowserConfiguration(target.served.artifact.server);
+    const configuration = (await effectiveAssistantBrowserConfiguration(target.served.artifact.server, client.tenant, deps.appearance)).effective;
     const roles = canonicalizeAuthorizationClaimValues(parsed.user.roles, 'role');
     const scopes = canonicalizeAuthorizationClaimValues(parsed.user.scopes, 'scope');
     // Hoisted so an elevation and a fresh exchange bind the *same* principal. Two constructions would be
@@ -142,7 +141,7 @@ export async function handleAssistantSession(req, res, deps) {
                 : {}),
             caller,
             configuration,
-            endpoints: assistantSessionEndpoints(deps.serviceBase(req), deps.sandboxBase?.(req)),
+            endpoints: assistantSessionEndpoints(deps.serviceBase(req)),
         });
     }
     const session = await deps.store.createSession({
@@ -166,7 +165,7 @@ export async function handleAssistantSession(req, res, deps) {
     const sessionBody = {
         token: session.token,
         expiresAt: session.session.expiresAt,
-        endpoints: assistantSessionEndpoints(deps.serviceBase(req), deps.sandboxBase?.(req)),
+        endpoints: assistantSessionEndpoints(deps.serviceBase(req)),
         ...(configuration ? { configuration } : {}),
     };
     // Every published @noodleseed/assistant widget consumes this shape; parse (don't just test)

package/node_modules/@noodle-borg/service/dist/service.js

@@ -1,4 +1,4 @@
-import { InMemoryAssistantStore, isAssistantSandboxHost, validateAssistantSandboxBaseUrl, } from '@noodle-borg/assistant-gateway/portable';
+import { InMemoryAssistantAppearanceSettingsStore, InMemoryAssistantStore, } from '@noodle-borg/assistant-gateway/portable';
 import { allowAllGate, InMemoryControlPlaneStore } from '@noodle-borg/control-plane/portable';
 import { dispatchKnowledgeRequest } from '@noodle-borg/knowledge-operations/portable';
 import { OPENAI_APPS_CHALLENGE_PATH } from '@noodle-borg/module';
@@ -50,9 +50,6 @@ const DEFAULT_MAX_BODY = 1 << 20;
 const DEFAULT_MAX_DEPLOY_BODY = 32 * 1024 * 1024;
 /** The combined service listener: tenant-scoped deploy management plus the multi-tenant MCP router. */
 export function createServiceHandler(registry, options = {}) {
-    const assistantSandboxBaseUrl = options.assistantSandboxBaseUrl === undefined
-        ? undefined
-        : validateAssistantSandboxBaseUrl(options.assistantSandboxBaseUrl, options.publicBaseUrl);
     const logger = options.logger ?? noopLogger;
     const tls = options.tls ?? {};
     const buildInfo = options.buildInfo ?? resolveBuildInfo();
@@ -62,6 +59,7 @@ export function createServiceHandler(registry, options = {}) {
     const alertRuleStore = options.alertRuleStore ?? new InMemoryAlertRuleStore();
     const [intentSettings, intentEvents, requestEvents, intentPreviewOrgs] = createObservabilityStores(options);
     const assistantStore = options.assistantStore ?? new InMemoryAssistantStore();
+    const assistantAppearance = options.assistantAppearance ?? new InMemoryAssistantAppearanceSettingsStore();
     const anonymousLimiter = new AnonymousConsumerLimiter();
     registry.setPlatformConnectors({ catalog: [BUILTIN_STATE_CATALOG_CONNECTOR], connectors: [] });
     const moduleProviders = createServiceModuleProviders({
@@ -158,14 +156,6 @@ export function createServiceHandler(registry, options = {}) {
     };
     return (req, res) => {
         const url = new URL(req.url ?? '/', 'http://localhost');
-        const onAssistantSandboxHost = isAssistantSandboxHost(req.headers.host, assistantSandboxBaseUrl);
-        if (onAssistantSandboxHost && url.pathname !== '/v1/assistant/sandbox') {
-            applySecurityHeaders(res, tls);
-            if (enforceHttps(req, res, tls))
-                return;
-            sendJson(res, 404, { error: 'not found' });
-            return;
-        }
         // Liveness/readiness probes: un-gated and **not** HTTPS-enforced — Cloud Run's internal probe is plain
         // HTTP, so enforcing HTTPS here would `426` the probe and the revision would never go healthy (ADR 0034).
         // `/healthz` is a pure liveness 200 (no store touch); `/readyz` reflects the injected readiness probe.
@@ -248,6 +238,7 @@ export function createServiceHandler(registry, options = {}) {
         if (dispatchAssistantRoutes(req, res, url, {
             registry,
             store: assistantStore,
+            appearance: assistantAppearance,
             ...(options.publicEmbeds !== undefined ? { publicEmbeds: options.publicEmbeds } : {}),
             ...(options.elevations !== undefined ? { elevations: options.elevations } : {}),
             ...(options.admissionCounters !== undefined
@@ -261,9 +252,6 @@ export function createServiceHandler(registry, options = {}) {
             audit: activeAudit,
             maxBody,
             serviceBase: (request) => options.publicBaseUrl ?? baseFromRequest(request, tls),
-            ...(assistantSandboxBaseUrl === undefined
-                ? {}
-                : { sandboxBase: () => assistantSandboxBaseUrl }),
             ...(options.assistantModelFetch !== undefined
                 ? { modelFetch: options.assistantModelFetch }
                 : {}),