@noodleseed/one 0.148.0 → 0.149.0

package/node_modules/@noodle-borg/service/dist/routes/assistant-agent.js

@@ -1,6 +1,6 @@
 import { ADMISSION_DEFAULTS } from '@noodle-borg/admission-limits/portable';
 import { assistantCoreModelMessages, assistantTurnModelContextMessages, requestAssistantSuggestedPrompts, requestModelCompletion, resolveAssistantContextProviderModelResult, } from '@noodle-borg/assistant-gateway/model-runtime';
-import { assistantGuideModelContext, assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, assistantViewAvailableData, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, toolTouchesDelegatedAuth, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { assistantGuideModelContext, assistantModelToolOncePerSession, assistantModelToolRequiredWhenVisible, assistantOmittedToolResult, assistantViewAvailableData, dispatchAssistantTool, projectAssistantGuide, publicSurfaceOf, selectAssistantModelTools, toolTouchesDelegatedAuth, withAssistantSessionExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { validateJsonSchemaWithDefaults } from '@noodle-borg/compiler';
 import { guardedFetch } from '@noodle-borg/connector-http';
 import { evaluateToolAuthorization } from '@noodle-borg/protocol';
@@ -8,6 +8,19 @@ import { interceptForElevation, offersSignIn } from './assistant-elevation.js';
 import { assistantKnowledgeModelTools, executeAssistantKnowledgeSearch, findAssistantKnowledgeComponent, KNOWLEDGE_CITATION_GUIDANCE, resolveAssistantKnowledge, } from './assistant-knowledge.js';
 import { resolveAssistantModelBinding } from './assistant-model-binding.js';
 const MAX_MODEL_RESPONSE = 1 << 20;
+/**
+ * The agent-loop bounds come from the admission envelope so an operator lowering them changes
+ * behaviour. They used to be a constant here that happened to equal the envelope's default, which
+ * meant the envelope documented a limit it did not control.
+ */
+function agentBounds(deps, policy) {
+    const { modelStepsPerTurn, toolCallsPerTurn } = deps.admissionEnvelope ?? ADMISSION_DEFAULTS;
+    // A per-tenant policy narrows a turn; it can never widen one, so the envelope wins when lower.
+    return {
+        steps: Math.min(modelStepsPerTurn, policy?.maxModelStepsPerTurn ?? modelStepsPerTurn),
+        toolCalls: Math.min(toolCallsPerTurn, policy?.maxToolCallsPerTurn ?? toolCallsPerTurn),
+    };
+}
 export function createAssistantTurnStats() {
     return {
         modelRequests: 0,
@@ -21,9 +34,12 @@ export function createAssistantTurnStats() {
 }
 /** Run one model/tool loop against the immutable invocation-context snapshot for this turn. */
 export async function runAgentTurn(target, session, message, context, deps, emit, modelContext, pageContext, stats = createAssistantTurnStats(), suggestions = false) {
+    // Every terminal failure in this loop is one shape: a code, and the turn ends. Naming it keeps the
+    // dozen sites readable and stops a new one inventing a different envelope.
+    const fail = (code) => emit({ event: 'error', data: { code } });
     const assistant = target.served.artifact.server.assistant;
     if (!assistant)
-        return emit({ event: 'error', data: { code: 'assistant_unavailable' } });
+        return fail('assistant_unavailable');
     const binding = await resolveAssistantModelBinding(target, session.tenant, session.deploymentId, deps);
     if (!binding) {
         return emit({
@@ -35,12 +51,18 @@ export async function runAgentTurn(target, session, message, context, deps, emit
             },
         });
     }
-    const knowledge = await resolveAssistantKnowledge(target.served);
-    let modelTools = selectTurnModelTools(target, session.caller, message, session.modelToolUses);
+    // Zero means offer none, from every source — not "call one and meet `tool_call_budget_exhausted`".
+    // A required tool and a knowledge tool each reach the model by their own path, so silencing only
+    // the ordinary ones would still advertise a tool the turn can never run.
+    const bounds = agentBounds(deps, binding.requestPolicy);
+    const toolless = bounds.toolCalls === 0;
+    const knowledge = toolless ? undefined : await resolveAssistantKnowledge(target.served);
+    let modelTools = toolless
+        ? []
+        : selectTurnModelTools(target, session.caller, message, session.modelToolUses);
     const requiredTools = modelTools.filter(assistantModelToolRequiredWhenVisible);
-    if (requiredTools.length > 1) {
-        return emit({ event: 'error', data: { code: 'multiple_required_model_tools' } });
-    }
+    if (requiredTools.length > 1)
+        return fail('multiple_required_model_tools');
     let requiredTool = requiredTools[0];
     const guideProjection = projectAssistantGuide({
         appPackage: target.served.appPackageSnapshot?.artifact,
@@ -73,19 +95,17 @@ export async function runAgentTurn(target, session, message, context, deps, emit
         ...session.history,
         { role: 'user', content: message },
     ];
-    const envelope = deps.admissionEnvelope ?? ADMISSION_DEFAULTS;
-    const bounds = { steps: envelope.modelStepsPerTurn, toolCalls: envelope.toolCallsPerTurn };
     // Across every step of this turn, not per step: eight tool calls is eight, however the model splits
     // them, or a model that loops one call per step would spend the budget a step at a time.
     let toolCallsThisTurn = 0;
+    let omittedToolRecoveries = 0;
     let remainingTokens = binding.requestPolicy?.maxTokensPerTurn;
     const turnSignal = binding.requestPolicy?.maxTurnMs === undefined
         ? undefined
         : AbortSignal.timeout(binding.requestPolicy.maxTurnMs);
     for (let step = 0; step < bounds.steps; step += 1) {
-        if (remainingTokens !== undefined && remainingTokens <= 0) {
-            return emit({ event: 'error', data: { code: 'model_token_budget_exhausted' } });
-        }
+        if (remainingTokens !== undefined && remainingTokens <= 0)
+            return fail('model_token_budget_exhausted');
         const requestTokenLimit = Math.min(binding.requestPolicy?.maxCompletionTokens ?? Number.MAX_SAFE_INTEGER, remainingTokens ?? Number.MAX_SAFE_INTEGER);
         const requiredToolForStep = requiredTool;
         const stepModelTools = requiredToolForStep === undefined ? modelTools : [requiredToolForStep];
@@ -106,12 +126,11 @@ export async function runAgentTurn(target, session, message, context, deps, emit
         }
         const response = completion.choices[0]?.message;
         if (!response)
-            return emit({ event: 'error', data: { code: 'invalid_model_response' } });
+            return fail('invalid_model_response');
         if (requiredToolForStep !== undefined &&
             (response.tool_calls?.length !== 1 ||
-                response.tool_calls[0]?.function.name !== requiredToolForStep.name)) {
-            return emit({ event: 'error', data: { code: 'required_model_tool_missing' } });
-        }
+                response.tool_calls[0]?.function.name !== requiredToolForStep.name))
+            return fail('required_model_tool_missing');
         if (!response.tool_calls?.length) {
             const assistantContent = response.content || streamedContent;
             if (assistantContent)
@@ -141,9 +160,8 @@ export async function runAgentTurn(target, session, message, context, deps, emit
         for (const call of response.tool_calls) {
             toolCallsThisTurn += 1;
             stats.toolCalls += 1;
-            if (toolCallsThisTurn > bounds.toolCalls) {
-                return emit({ event: 'error', data: { code: 'tool_call_budget_exhausted' } });
-            }
+            if (toolCallsThisTurn > bounds.toolCalls)
+                return fail('tool_call_budget_exhausted');
             const knowledgeComponent = findAssistantKnowledgeComponent(knowledge, call.function.name);
             if (knowledge !== undefined && knowledgeComponent !== undefined) {
                 let knowledgeArgs;
@@ -151,7 +169,7 @@ export async function runAgentTurn(target, session, message, context, deps, emit
                     knowledgeArgs = JSON.parse(call.function.arguments);
                 }
                 catch {
-                    return emit({ event: 'error', data: { code: 'invalid_tool_arguments' } });
+                    return fail('invalid_tool_arguments');
                 }
                 emit({ event: 'tool_started', data: { id: call.id, tool: call.function.name } });
                 messages.push({
@@ -163,7 +181,19 @@ export async function runAgentTurn(target, session, message, context, deps, emit
             }
             const tool = stepModelTools.find((candidate) => candidate.name === call.function.name);
             if (!tool) {
-                return emit({ event: 'error', data: { code: 'invalid_model_tool_call' } });
+                // Tell the model rather than ending the turn on a bare error; `assistantOmittedToolResult`
+                // carries the reasoning. Once per turn: a model that insists after being told is the
+                // protocol violation the error code exists for, and it stops paying for extra steps.
+                if (omittedToolRecoveries > 0)
+                    return fail('invalid_model_tool_call');
+                omittedToolRecoveries += 1;
+                modelTools = [];
+                messages.push({
+                    role: 'tool',
+                    tool_call_id: call.id,
+                    content: assistantOmittedToolResult(call.function.name),
+                });
+                continue;
             }
             // A mixed surface turns "denied" into "sign in first". The intercept runs BEFORE the
             // authorization denial — an ADR 0185-gated tool is exactly what an anonymous visitor signs
@@ -195,22 +225,20 @@ export async function runAgentTurn(target, session, message, context, deps, emit
                 });
                 continue;
             }
-            if (!evaluateToolAuthorization(tool.authorization, session.caller).allow) {
-                return emit({ event: 'error', data: { code: 'invalid_model_tool_call' } });
-            }
+            if (!evaluateToolAuthorization(tool.authorization, session.caller).allow)
+                return fail('invalid_model_tool_call');
             let args;
             try {
                 args = JSON.parse(call.function.arguments);
             }
             catch {
-                return emit({ event: 'error', data: { code: 'invalid_tool_arguments' } });
+                return fail('invalid_tool_arguments');
             }
             // Validate AND apply schema defaults; the pending record and the execution below both use
             // the coerced copy, so the confirmed call equals the executed call (roadmap S5).
             const coerced = validateJsonSchemaWithDefaults(tool.inputSchema, args);
-            if (coerced.issues.length > 0) {
-                return emit({ event: 'error', data: { code: 'invalid_tool_arguments' } });
-            }
+            if (coerced.issues.length > 0)
+                return fail('invalid_tool_arguments');
             args = coerced.value;
             const dispatch = await dispatchAssistantTool({
                 artifact: target.served.artifact,
@@ -250,7 +278,7 @@ export async function runAgentTurn(target, session, message, context, deps, emit
             });
         }
     }
-    emit({ event: 'error', data: { code: 'step_limit' } });
+    fail('step_limit');
 }
 /** Generate an initial prompt set from the same exact surface/context assembly as an ordinary turn. */
 export async function generateInitialAssistantSuggestions(target, session, context, deps, modelContext, pageContext) {

package/node_modules/@noodle-borg/service/dist/routes/assistant-embeds.js

@@ -1,8 +1,19 @@
 import { ADMISSION_DEFAULTS, clamp } from '@noodle-borg/admission-limits/portable';
-import { publicSurfaceOf, surfaceEnvelope } from '@noodle-borg/assistant-gateway/portable';
+import { assistantEmbedOperatorView, parsePublicEmbedBudget, publicSurfaceOf, surfaceEnvelope, } from '@noodle-borg/assistant-gateway/portable';
 import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
 import { now } from './assistant-route-http.js';
 import { authorizeControlPlane } from './control-plane.js';
+/**
+ * The operator's view of a tenant's public surfaces, and the one control over them.
+ *
+ * `PATCH` sets the daily caps; `--turns-per-day 0` is the kill switch, and it is deliberately the only
+ * documented one. Revoking an embed would also stop a surface, but it destroys the paste-once id and
+ * every page carrying it, so it stays an exceptional action rather than the routine off-switch.
+ *
+ * Origins, capabilities, and surfaceMode are read from the *active* deployment rather than the embed
+ * row, so what an operator sees here is what a browser will actually be held to at mint time (the row
+ * keeps its provisioning-time mode by design — `ensure` never overwrites a live row).
+ */
 export async function handleAssistantEmbeds(req, res, tenant, embedId, deps) {
     const identity = await authorizeControlPlane(req, res, deps.gate, { requireIdentity: false });
     if (identity === false)
@@ -30,7 +41,7 @@ export async function handleAssistantEmbeds(req, res, tenant, embedId, deps) {
         const body = await readJsonBody(req, deps.maxBody);
         if (!body.ok)
             return sendJson(res, body.status, { error: body.error });
-        const budget = parseBudget(body.value);
+        const budget = parsePublicEmbedBudget(body.value);
         if (!budget.ok)
             return sendJson(res, 400, { error: budget.error });
         const updated = await embeds.setBudget(embedId, budget.value, now(deps));
@@ -46,44 +57,21 @@ export async function handleAssistantEmbeds(req, res, tenant, embedId, deps) {
     res.setHeader('Allow', embedId === undefined ? 'GET' : 'PATCH');
     return sendJson(res, 405, { error: 'method not allowed' });
 }
-function parseBudget(body) {
-    const { turnsPerDay, mintsPerDay } = body;
-    const value = {};
-    for (const [name, raw] of [
-        ['turnsPerDay', turnsPerDay],
-        ['mintsPerDay', mintsPerDay],
-    ]) {
-        if (raw === undefined)
-            continue;
-        // Zero is valid and is the point; anything negative or fractional is a mistake worth saying out
-        // loud rather than silently flooring, because an operator setting a cap is being deliberate.
-        if (typeof raw !== 'number' || !Number.isInteger(raw) || raw < 0) {
-            return { ok: false, error: `"${name}" must be a non-negative integer` };
-        }
-        value[name] = raw;
-    }
-    if (Object.keys(value).length === 0) {
-        return { ok: false, error: 'set at least one of "turnsPerDay" or "mintsPerDay"' };
-    }
-    return { ok: true, value };
-}
 async function view(record, tenant, defaults, deps, counters) {
     const target = await deps.registry.getActiveByTenant(tenant);
-    const surface = publicSurfaceOf(target?.served.artifact.server.assistant);
-    // Clamped even for the pure-default case, so what an operator reads is what admission will enforce.
-    const envelope = surfaceEnvelope(clamp(defaults), record);
     const at = now(deps);
-    return {
-        embedId: record.embedId,
-        surfaceMode: surface?.mode ?? record.surfaceMode,
-        origins: surface?.origins ?? [],
-        capabilities: surface?.capabilities.map((entry) => entry.name) ?? [],
-        turnsPerDay: envelope.turnsPerDay,
-        mintsPerDay: envelope.mintsPerDay,
-        budgetIsDefault: record.turnsPerDay === undefined && record.mintsPerDay === undefined,
-        turnsToday: await counters.peek(`turns:${record.embedId}`, at),
-        mintsToday: await counters.peek(`mints:${record.embedId}`, at),
-        createdAt: record.createdAt.toISOString(),
-    };
+    // The same bounds admission resolves, not the bare defaults: a sponsored surface enforces the
+    // hosted envelope, and reporting the unsponsored one told an operator a number nothing honours.
+    const deploymentId = target?.deploymentId ?? '';
+    const bounds = (await deps.managedModelResolver?.resolve({ tenant, deploymentId }))
+        ?.publicAdmission;
+    return assistantEmbedOperatorView({
+        record,
+        surface: publicSurfaceOf(target?.served.artifact.server.assistant),
+        // Clamped even for the pure-default case, so what an operator reads is what admission enforces.
+        envelope: surfaceEnvelope(clamp(defaults), record, bounds),
+        peek: (key) => counters.peek(key, at),
+        ...(bounds?.spend === undefined ? {} : { spend: bounds.spend }),
+    });
 }
 //# sourceMappingURL=assistant-embeds.js.map

package/node_modules/@noodle-borg/service/dist/routes/assistant-model-binding.js

@@ -5,10 +5,7 @@ export async function resolveAssistantModelBinding(target, tenant, deploymentId,
     if (declaration === undefined)
         return undefined;
     if (declaration.kind === 'noodle-managed') {
-        return deps.managedModelResolver?.resolve({
-            tenant,
-            deploymentId,
-        });
+        return deps.managedModelResolver?.resolve({ tenant, deploymentId });
     }
     const scope = resolveConfigScope(tenant);
     const [variables, secrets] = await Promise.all([

package/node_modules/@noodle-borg/service/dist/routes/assistant-public-session.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { ADMISSION_DEFAULTS, clientAddressBucket } from '@noodle-borg/admission-limits/portable';
 import { effectiveAssistantBrowserConfiguration, mintPublicSession, publicEmbedTenant, publicSurfaceOf, } from '@noodle-borg/assistant-gateway/portable';
-import { assistantSessionUsageRequestEvent, captureAssistantUsage, } from '@noodle-borg/observability';
+import { assistantSessionUsageRequestEvent, captureAssistantUsage, captureRefusedAssistantSession, } from '@noodle-borg/observability';
 import { assistantSessionResponseSchema } from '@noodle-borg/wire-contracts';
 import { readJsonBody, sendJson } from '../http-util.js';
 import { applyBrowserCors, assistantSessionEndpoints, now } from './assistant-route-http.js';
@@ -25,7 +25,7 @@ export async function handlePublicAssistantSession(req, res, deps) {
     const body = await readJsonBody(req, deps.maxBody);
     if (!body.ok)
         return sendJson(res, body.status, { error: body.error });
-    const { embedId } = body.value;
+    const { embedId, visitorId } = body.value;
     // The browser's Origin header is the claim under test. The body never asserts its own origin.
     const origin = typeof req.headers.origin === 'string' ? req.headers.origin : undefined;
     // Admission tier 3. Hashed here so no raw address crosses into the decision, a counter key, or an
@@ -36,7 +36,7 @@ export async function handlePublicAssistantSession(req, res, deps) {
     let configuration;
     let sponsoredBudget;
     let usageSession;
-    const result = await mintPublicSession({ embedId, origin, ...(addressBucket ? { addressBucket } : {}) }, deps.admissionEnvelope ?? ADMISSION_DEFAULTS, {
+    const result = await mintPublicSession({ embedId, visitorId, origin, ...(addressBucket ? { addressBucket } : {}) }, deps.admissionEnvelope ?? ADMISSION_DEFAULTS, {
         embeds,
         counters,
         resolveActiveSurface: async (embed) => {
@@ -86,6 +86,10 @@ export async function handlePublicAssistantSession(req, res, deps) {
         now: () => now(deps),
     });
     if (!result.ok) {
+        // A refusal the surface owns is usage. Without it an operator whose visitors are being turned
+        // away sees a healthy-looking page; which refusals count is the helper's decision, not this one's.
+        const refusedIn = performance.now() - usageStartedAt;
+        captureRefusedAssistantSession(deps.captureRequestEvent, result, refusedIn);
         return sendJson(res, result.status, { error: result.message, code: result.code });
     }
     // Only here, with the origin proven against the live surface, may the page read the response.

package/node_modules/@noodle-borg/service/dist/routes/assistant.js

@@ -174,6 +174,16 @@ export async function handleAssistantSession(req, res, deps) {
     captureAssistantUsage(deps.captureRequestEvent, assistantSessionUsageRequestEvent(session.session, performance.now() - usageStartedAt));
     return sendJson(res, 201, sessionBody);
 }
+/**
+ * Both turn entries — a resume and a typed message — refuse identically: the refusal is spent
+ * budget, so it is recorded against the surface before the caller is told no. Kept in one place so
+ * the two entries cannot drift into recording it differently.
+ */
+function refuseTurn(deps, res, session, refusal, usageStartedAt) {
+    const durationMs = performance.now() - usageStartedAt;
+    captureAssistantUsage(deps.captureRequestEvent, assistantRefusedTurnUsageRequestEvent(session, refusal.code, durationMs));
+    sendJson(res, refusal.status, { error: refusal.message, code: refusal.code });
+}
 export async function handleAssistantTurn(req, res, deps) {
     const usageStartedAt = performance.now();
     const session = await authenticateSession(req, res, deps);
@@ -201,10 +211,8 @@ export async function handleAssistantTurn(req, res, deps) {
         }
         suggestionsRequested = resumeResult.data.suggestions === true;
         const refusal = await refusePublicTurn(deps, session, 'resume', addressBucket);
-        if (refusal) {
-            captureAssistantUsage(deps.captureRequestEvent, assistantRefusedTurnUsageRequestEvent(session, refusal.code, performance.now() - usageStartedAt));
-            return sendJson(res, refusal.status, { error: refusal.message, code: refusal.code });
-        }
+        if (refusal)
+            return refuseTurn(deps, res, session, refusal, usageStartedAt);
         const pending = await deps.store.consumePendingResume(session.id);
         if (!pending) {
             return sendJson(res, 409, {
@@ -252,10 +260,8 @@ export async function handleAssistantTurn(req, res, deps) {
         // Admission before any metered work (ADR 0201 §8): ahead of the deployment read and well ahead
         // of the model, so a refused turn costs the customer nothing.
         const refusal = await refusePublicTurn(deps, session, message, addressBucket);
-        if (refusal) {
-            captureAssistantUsage(deps.captureRequestEvent, assistantRefusedTurnUsageRequestEvent(session, refusal.code, performance.now() - usageStartedAt));
-            return sendJson(res, refusal.status, { error: refusal.message, code: refusal.code });
-        }
+        if (refusal)
+            return refuseTurn(deps, res, session, refusal, usageStartedAt);
         // The visitor typed first: any pending post-sign-in resume is moot, and must not fire later.
         if (session.pendingResume)
             await deps.store.consumePendingResume(session.id);

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.87.1",
+    "@noodle-borg/agent-kit": "0.88.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/transport-http/dist/request-capture.js

@@ -77,6 +77,7 @@ export function emitRequestEvent(input) {
         ...(clientVersion !== undefined ? { clientVersion } : {}),
         clientFamily: family,
         ...(auth.accessMode !== undefined ? { accessMode: auth.accessMode } : {}),
+        surface: 'mcp',
         subjectKind: subject !== undefined ? 'authenticated' : 'anonymous',
         method,
         kind: DISCOVERY_METHODS.has(method) ? 'discovery' : 'usage',
@@ -147,6 +148,7 @@ export function emitDeniedRequestEvent(input) {
         sessionSource: 'none',
         clientFamily: clientFamily(undefined, header(req, 'user-agent')),
         ...(auth.accessMode !== undefined ? { accessMode: auth.accessMode } : {}),
+        surface: 'mcp',
         subjectKind: 'anonymous',
         method,
         kind: 'usage',

package/node_modules/@noodleseed/assistant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.28.0",
+  "version": "1.29.0",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.148.0",
+  "version": "0.149.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -236,7 +236,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.87.1",
+    "@noodle-borg/agent-kit": "0.88.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",