@noodleseed/one 0.190.0 → 0.190.1

package/node_modules/@noodle-borg/agent-kit/dist/curated/error-fixes.js

@@ -76,6 +76,7 @@ export const ERROR_FIXES = {
     interaction_field_control_mismatch: 'Match each control to the action input type: `consent` needs `z.literal(true)`, `select` needs `z.enum([...])` of strings, and `text`/`textarea`/`email`/`phone`/`url` need a string schema.',
     interaction_field_missing: 'Collect or seed every required action input (a `fields` entry or an `initialValues` entry), mark a not-required field `optional: true`, and let an optional-but-required string accept `""`.',
     interaction_initial_value_unknown: 'Key `initialValues` by an action input property and set `fromOutput` to a property of this opener’s `output` schema.',
+    interaction_initial_value_private: 'Remove this `initialValues` entry and let the platform collect the `private: true` field; the opener’s output comes from the model, so seeding a private field would route its value through the model.',
     interaction_consent_invalid: 'Keep exactly one `control: "consent"` field; the runtime poses one consent question, never several.',
     interaction_expiry_invalid: 'Set `confirmationExpiry.seconds` to a whole number from 1 to 86400; a developer may only shorten the channel profile’s default.',
     channel_dependency_missing: 'Select the opener and its `interaction.action` together in the same `publicMessaging({ capabilities })` list; natural collection needs the confirmed action it prepares.',

package/node_modules/@noodle-borg/agent-kit/dist/generated/surface.js

@@ -182,6 +182,7 @@ export const COMPILE_ERROR_CODES = [
     'interaction_field_control_mismatch',
     'interaction_field_missing',
     'interaction_initial_value_unknown',
+    'interaction_initial_value_private',
     'interaction_consent_invalid',
     'interaction_expiry_invalid',
     'channel_dependency_missing',

package/node_modules/@noodle-borg/agent-kit/dist/skill-embedded-assistant-ref.js

@@ -44,7 +44,7 @@ export function renderEmbeddedAssistantReference() {
         '- `action` is a tool with `annotations.openAction({ confirm: true })` (never read-only) whose fulfilment saves one native record through `connectors.records`.',
         '- `fields` name the action’s Zod input keys with one of seven controls: `text`, `textarea`, `email`, `phone`, `url`, `select` (a `z.enum` of strings) and `consent` (`z.literal(true)`, at most one; the runtime poses the consent question and never infers it).',
         '- Nothing is private by default. `private: true` keeps that value out of the conversation model, transcript, logs and diagnostics. `optional: true` lets a person skip a field; an optional field the schema still requires must accept `""`.',
-        '- `initialValues: { workflow: { fromOutput: "workflow" } }` seeds action inputs from the opener’s `output`; every other required action input must be a field.',
+        '- `initialValues: { workflow: { fromOutput: "workflow" } }` seeds action inputs from the opener’s `output`; every other required action input must be a field. Never seed a `private: true` field: the opener’s output comes from the model, so the compiler refuses it and the platform collects that value privately.',
         '- `confirmationExpiry: { seconds }` may only shorten the channel’s default (ten minutes on WhatsApp), never lengthen it.',
         '- On `publicMessaging`, list the opener and its action together. The compiler reports `channel_dependency_missing` for an opener selected alone and `channel_requirement_unsupported` for a widget, write or external connector call that has no collect interaction.',
         '',

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.113.0",
+  "version": "0.113.1",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/compiler/dist/errors.d.ts

@@ -1,7 +1,7 @@
 import type { AppPackageArtifactV1 } from '@noodle-borg/app-package';
 import type { RuntimeArtifact } from './artifact/types.js';
 import type { PackagedAsset } from './assets.js';
-export type CompileErrorCode = 'invalid_context_provider' | 'yaml_parse_error' | 'invalid_shape' | 'invalid_name' | 'duplicate_name' | 'reserved_name' | 'unsupported_manifest_version' | 'reserved_for_future_version' | 'invalid_operation_ref' | 'external_ref' | 'invalid_schema_ref' | 'unknown_schema_ref' | 'schema_ref_conflict' | 'invalid_expression' | 'expr_unknown_root' | 'expr_root_unavailable' | 'expr_operator_not_allowed' | 'expr_if_not_boolean' | 'unknown_step_ref' | 'forward_step_ref' | 'self_step_ref' | 'duplicate_step_id' | 'invalid_fulfilment' | 'invalid_elicitation_schema' | 'invalid_elicitation_flow' | 'invalid_confirmation_flow' | 'arg_type_mismatch' | 'ambient_context_action' | 'duplicate_resource' | 'duplicate_prompt' | 'duplicate_resource_uri' | 'unsupported_uri_template' | 'duplicate_widget' | 'unknown_widget_tool' | 'unknown_widget_action_tool' | 'duplicate_widget_tool' | 'invalid_widget_binding' | 'invalid_widget_state_handle' | 'widget_html_too_large' | 'widget_html_total_too_large' | 'invalid_asset' | 'invalid_capability_requirement' | 'state_secret_field' | 'invalid_knowledge' | 'knowledge_unhashed' | 'invalid_managed_collection' | 'invalid_variable_declaration' | 'invalid_managed_collection_source' | 'unknown_connector_alias' | 'connector_not_in_catalog' | 'unknown_operation' | 'connector_binding_required' | 'ambiguous_nested_connector_binding' | 'invalid_connector_call_graph' | 'unsupported_credential_profile' | 'credential_scope_mismatch' | 'credential_audience_mismatch' | 'customer_endpoint_auth_required' | 'customer_endpoint_mapping_required' | 'customer_endpoint_unknown_mapping' | 'customer_endpoint_bridge_unsupported' | 'assistant_messaging_unsupported' | 'assistant_capability_unknown' | 'assistant_public_user_reference' | 'assistant_public_effect_unconfirmed' | 'tool_anonymous_requires_identity' | 'interaction_action_invalid' | 'interaction_field_unknown' | 'interaction_field_control_mismatch' | 'interaction_field_missing' | 'interaction_initial_value_unknown' | 'interaction_consent_invalid' | 'interaction_expiry_invalid' | 'channel_dependency_missing' | 'channel_requirement_unsupported' | 'customer_endpoint_action_unsupported' | 'customer_endpoint_surface_unsupported' | 'customer_endpoint_credential_source_unsupported' | 'customer_endpoint_policy_conflict' | 'customer_endpoint_routing_inconsistent' | 'unused_connector_alias' | 'arg_mismatch' | 'agent_guide_invalid' | 'agent_guide_duplicate_workflow' | 'agent_guide_duplicate_example' | 'agent_guide_example_workflow_missing' | 'agent_guide_capability_missing' | 'agent_guide_capability_kind' | 'app_package_sensitive_content';
+export type CompileErrorCode = 'invalid_context_provider' | 'yaml_parse_error' | 'invalid_shape' | 'invalid_name' | 'duplicate_name' | 'reserved_name' | 'unsupported_manifest_version' | 'reserved_for_future_version' | 'invalid_operation_ref' | 'external_ref' | 'invalid_schema_ref' | 'unknown_schema_ref' | 'schema_ref_conflict' | 'invalid_expression' | 'expr_unknown_root' | 'expr_root_unavailable' | 'expr_operator_not_allowed' | 'expr_if_not_boolean' | 'unknown_step_ref' | 'forward_step_ref' | 'self_step_ref' | 'duplicate_step_id' | 'invalid_fulfilment' | 'invalid_elicitation_schema' | 'invalid_elicitation_flow' | 'invalid_confirmation_flow' | 'arg_type_mismatch' | 'ambient_context_action' | 'duplicate_resource' | 'duplicate_prompt' | 'duplicate_resource_uri' | 'unsupported_uri_template' | 'duplicate_widget' | 'unknown_widget_tool' | 'unknown_widget_action_tool' | 'duplicate_widget_tool' | 'invalid_widget_binding' | 'invalid_widget_state_handle' | 'widget_html_too_large' | 'widget_html_total_too_large' | 'invalid_asset' | 'invalid_capability_requirement' | 'state_secret_field' | 'invalid_knowledge' | 'knowledge_unhashed' | 'invalid_managed_collection' | 'invalid_variable_declaration' | 'invalid_managed_collection_source' | 'unknown_connector_alias' | 'connector_not_in_catalog' | 'unknown_operation' | 'connector_binding_required' | 'ambiguous_nested_connector_binding' | 'invalid_connector_call_graph' | 'unsupported_credential_profile' | 'credential_scope_mismatch' | 'credential_audience_mismatch' | 'customer_endpoint_auth_required' | 'customer_endpoint_mapping_required' | 'customer_endpoint_unknown_mapping' | 'customer_endpoint_bridge_unsupported' | 'assistant_messaging_unsupported' | 'assistant_capability_unknown' | 'assistant_public_user_reference' | 'assistant_public_effect_unconfirmed' | 'tool_anonymous_requires_identity' | 'interaction_action_invalid' | 'interaction_field_unknown' | 'interaction_field_control_mismatch' | 'interaction_field_missing' | 'interaction_initial_value_unknown' | 'interaction_initial_value_private' | 'interaction_consent_invalid' | 'interaction_expiry_invalid' | 'channel_dependency_missing' | 'channel_requirement_unsupported' | 'customer_endpoint_action_unsupported' | 'customer_endpoint_surface_unsupported' | 'customer_endpoint_credential_source_unsupported' | 'customer_endpoint_policy_conflict' | 'customer_endpoint_routing_inconsistent' | 'unused_connector_alias' | 'arg_mismatch' | 'agent_guide_invalid' | 'agent_guide_duplicate_workflow' | 'agent_guide_duplicate_example' | 'agent_guide_example_workflow_missing' | 'agent_guide_capability_missing' | 'agent_guide_capability_kind' | 'app_package_sensitive_content';
 export interface CompileError {
     readonly code: CompileErrorCode;
     /** Dotted path to the offending location (e.g. `tools.1.name`); empty string for the document root. */

package/node_modules/@noodle-borg/compiler/dist/manifest/interaction-validation.js

@@ -101,6 +101,13 @@ function validateCollect(interaction, opener, byName, path, errors) {
                 message: `initial value "${target}" is not an input of action "${action.name}"`,
             });
         }
+        else if (interaction.fields.some((field) => field.key === target && field.private === true)) {
+            errors.push({
+                code: 'interaction_initial_value_private',
+                path: valuePath,
+                message: `private field "${target}" is collected by the platform and cannot be seeded from the opener's output`,
+            });
+        }
         else {
             covered.add(target);
         }

package/node_modules/@noodle-borg/service/package.json

@@ -41,7 +41,7 @@
     "@noodle-borg/managed-capabilities": "0.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.113.0",
+    "@noodle-borg/agent-kit": "0.113.1",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.190.0",
+  "version": "0.190.1",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -236,7 +236,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.113.0",
+    "@noodle-borg/agent-kit": "0.113.1",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",