drafted 1.1.4 → 1.2.0

package/mcp/server.mjs

@@ -478,6 +478,43 @@ async function checkAnchors(layer) {
     `Read all anchored frames first, then retry your operation.`;
 }
 
+// ── Project skill enforcement ─────────────────────────────────────
+// Skills attached to a project must be loaded by the agent before any
+// mutating operation in that project. Same shape as anchor enforcement.
+const loadedSkillIds = new Set();
+const projectSkillsCache = new Map(); // projectId -> { data, time }
+
+async function getProjectSkills(projectId) {
+  if (!projectId) return [];
+  const cached = projectSkillsCache.get(projectId);
+  if (cached && Date.now() - cached.time < 10000) return cached.data;
+  try {
+    const result = await api('GET', `/api/projects/${projectId}/skills`);
+    const skills = Array.isArray(result?.skills) ? result.skills : (Array.isArray(result) ? result : []);
+    projectSkillsCache.set(projectId, { data: skills, time: Date.now() });
+    return skills;
+  } catch {
+    return [];
+  }
+}
+
+function invalidateProjectSkillsCache(projectId) {
+  if (projectId) projectSkillsCache.delete(projectId);
+}
+
+async function checkProjectSkills(projectId) {
+  if (!projectId) return null;
+  const skills = await getProjectSkills(projectId);
+  if (skills.length === 0) return null;
+  const unloaded = skills.filter(s => !loadedSkillIds.has(s.id));
+  if (unloaded.length === 0) return null;
+
+  const lines = unloaded.map(s => `  skill(action="load", skill="${s.slug || s.id}")  -- ${s.name}`);
+  return `This project has ${skills.length} attached skill(s) that must be loaded before making changes. ` +
+    `Unloaded skills:\n${lines.join('\n')}\n\n` +
+    `Load all attached skills first, then retry your operation. Skills tell you HOW to do the work — they're not optional.`;
+}
+
 // ── CLI passthrough (for login/start/stop only) ───────────────────
 
 function runCLI(command, args = [], options = {}) {
@@ -602,7 +639,7 @@ tool('auth', 'Sign in to Drafted. `action=get_link` returns a verification URL i
 
 // ── Project management tools (direct HTTP) ────────────────────────
 
-tool('project', 'START HERE for project management. Dispatch by `action`: list (lists all projects across all orgs — always call first), open (switch the active project; required before reading/writing frames), create (new project, optionally from a template), update (change name/folder/description/layers), move (transfer to another org). The org switches automatically when you open a project.', {
+tool('project', 'START HERE for project management. Dispatch by `action`: list (lists all projects across all orgs — always call first), open (switch the active project; required before reading/writing frames), create (new project, optionally from a template), update (change name/folder/description/layers), move (transfer to another org). The org switches automatically when you open a project. **Skill gate:** projects with attached skills will REJECT all mutations (write, edit, mv, rm, shape, group, connector, layout, layer, asset upload) until you have loaded each attached skill via skill(action="load"). Skills tell you HOW to do the work — they\'re not optional. Open returns the attached skill list and auto-inlines content for projects with ≤3 skills.', {
   action: z.enum(['list', 'open', 'create', 'update', 'move']).describe('Operation to perform.'),
   projectId: z.string().optional().describe('[open|update|move] project ID. Get IDs from action=list.'),
   name: z.string().optional().describe('[create|update] project name'),
@@ -683,11 +720,27 @@ tool('project', 'START HERE for project management. Dispatch by `action`: list (
               const full = await api('GET', `/api/skills/${s.id}`);
               s.content = full.content;
               s.files = full.files || [];
+              // Skill content was inlined in this response — count it as loaded
+              // so the project-skill gate doesn't immediately demand a re-load.
+              loadedSkillIds.add(s.id);
             } catch { /* skip */ }
           }
         }
 
-        return ok({ ...result, url, opened: true, navigated, skills: projectSkillsList });
+        // Refresh project-skill cache so the gate uses fresh data after open
+        invalidateProjectSkillsCache(projectId);
+
+        const responseExtras = { url, opened: true, navigated, skills: projectSkillsList };
+        if (projectSkillsList.length > 3) {
+          const unloaded = projectSkillsList.filter(s => !loadedSkillIds.has(s.id));
+          if (unloaded.length > 0) {
+            responseExtras.skillGateNotice =
+              `This project has ${projectSkillsList.length} attached skills (too many to auto-inline). ` +
+              `You MUST call skill(action="load") for each before any mutation. Unloaded: ` +
+              unloaded.map(s => s.slug || s.id).join(', ');
+          }
+        }
+        return ok({ ...result, ...responseExtras });
       }
       case 'create': {
         const { name, description, templateSlug } = args;
@@ -862,6 +915,8 @@ tool('layer', 'Manage layers in a project. Dispatch by `action`: add/update/remo
   try {
     const { action, projectId } = args;
     if (!projectId) throw new Error('projectId is required');
+    const skillErr = await checkProjectSkills(projectId);
+    if (skillErr) return err(new Error(skillErr));
     switch (action) {
       case 'add': {
         const { key, label, type, width, height, description, prompt } = args;
@@ -1026,6 +1081,8 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         if (!path) throw new Error('path required for action=write');
         if (content != null && file_path) throw new Error('Provide content OR file_path, not both');
         if (content == null && !file_path) throw new Error('Provide content or file_path');
+        const skillErr = await checkProjectSkills(getState().projectId);
+        if (skillErr) return err(new Error(skillErr));
         const anchorErr = await checkAnchors(parseLayer(path));
         if (anchorErr) return err(new Error(anchorErr));
         const parts = path.replace(/^\/+/, '').split('/');
@@ -1061,6 +1118,8 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         const { path, operations } = args;
         if (!path) throw new Error('path required for action=edit');
         if (!Array.isArray(operations) || operations.length === 0) throw new Error('operations (array) required for action=edit');
+        const skillErr = await checkProjectSkills(getState().projectId);
+        if (skillErr) return err(new Error(skillErr));
         const anchorErr = await checkAnchors(parseLayer(path));
         if (anchorErr) return err(new Error(anchorErr));
         const result = await api('POST', '/api/fs/edit', { path, operations });
@@ -1072,6 +1131,8 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
       case 'mv': {
         const { from, to } = args;
         if (!from || !to) throw new Error('from and to required for action=mv');
+        const skillErr = await checkProjectSkills(getState().projectId);
+        if (skillErr) return err(new Error(skillErr));
         const fromErr = await checkAnchors(parseLayer(from));
         if (fromErr) return err(new Error(fromErr));
         const toErr = await checkAnchors(parseLayer(to));
@@ -1082,6 +1143,8 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         const { path, anchored } = args;
         if (!path) throw new Error('path required for action=anchor');
         if (typeof anchored !== 'boolean') throw new Error('anchored (boolean) required for action=anchor');
+        const skillErr = await checkProjectSkills(getState().projectId);
+        if (skillErr) return err(new Error(skillErr));
         return ok(await api('POST', '/api/fs/anchor', { path, anchored }));
       }
       case 'search': {
@@ -1174,6 +1237,8 @@ tool('rm', 'Delete a frame or lane from the ACTIVE PROJECT. Response includes "p
   path: z.string().describe('Path to delete: /{layer}/{lane}/{filename} or /{layer}/{lane} (deletes entire lane).'),
 }, async ({ path }) => {
   try {
+    const skillErr = await checkProjectSkills(getState().projectId);
+    if (skillErr) return err(new Error(skillErr));
     const anchorErr = await checkAnchors(parseLayer(path));
     if (anchorErr) return err(new Error(anchorErr));
     const clean = path.replace(/^\/+|\/+$/g, '');
@@ -1303,6 +1368,8 @@ tool('asset', 'Manage supporting files (CSS, JS, images, fonts) in the ACTIVE PR
     const projectId = getState().projectId;
     if (!projectId) throw new Error('No active project. Call project(action="open") first.');
     if (action === 'upload') {
+      const skillErr = await checkProjectSkills(projectId);
+      if (skillErr) return err(new Error(skillErr));
       const { asset_path, file_path, content, base64: rawBase64, content_type, frame_id } = args;
       if (!asset_path) throw new Error('asset_path is required for action=upload');
       if (asset_path.includes('..')) throw new Error('asset_path must not contain ".."');
@@ -1351,6 +1418,8 @@ tool('shape', 'Create a flowchart shape on the surface. Shapes are lightweight t
   layoutIgnore: z.boolean().optional().describe('Exclude this shape from auto-layout. Use for annotations, labels, or manually positioned elements.'),
 }, async ({ text, shape, layer, lane, color, fill, textColor, group, width, height, layoutIgnore }) => {
   try {
+    const skillErr = await checkProjectSkills(getState().projectId);
+    if (skillErr) return err(new Error(skillErr));
     const body = { text, shape };
     if (layer) body.layer = layer;
     if (lane) body.lane = lane;
@@ -1375,6 +1444,8 @@ tool('group', 'Create a group (swim lane / region) on the surface. Groups are la
   order: z.number().optional().describe('Sort order for group positioning (lower = first). Default: 0'),
 }, async ({ label, color, fill, layer, lane, order }) => {
   try {
+    const skillErr = await checkProjectSkills(getState().projectId);
+    if (skillErr) return err(new Error(skillErr));
     const body = { label };
     if (color) body.color = color;
     if (fill) body.fill = fill;
@@ -1397,6 +1468,8 @@ tool('connector', 'Create or remove connectors (arrows) between frames on the su
   connectorId: z.string().optional().describe('[disconnect] connector ID to delete directly'),
 }, async (args) => {
   try {
+    const skillErr = await checkProjectSkills(getState().projectId);
+    if (skillErr) return err(new Error(skillErr));
     const { action } = args;
     if (action === 'connect') {
       const { source, target, label, type = 'arrow-forward', color } = args;
@@ -1438,6 +1511,8 @@ tool('layout', 'Auto-arrange frames using graph layout algorithm. Positions conn
   groups: z.boolean().optional().default(false).describe('Enable group clustering. When true, shapes assigned to a group (via the group param) are clustered together, and group frames are resized to enclose their members.'),
 }, async ({ direction, groups }) => {
   try {
+    const skillErr = await checkProjectSkills(getState().projectId);
+    if (skillErr) return err(new Error(skillErr));
     const body = { direction };
     if (groups) body.groups = true;
     const result = await api('POST', '/api/layout', body);
@@ -1492,7 +1567,9 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
         if (!skill) throw new Error('skill (ID or slug) is required for action=load');
         const isUuid = /^[a-f0-9-]{36}$/.test(skill);
         const endpoint = isUuid ? `/api/skills/${skill}` : `/api/skills/slug/${skill}`;
-        return ok(await api('GET', endpoint));
+        const result = await api('GET', endpoint);
+        if (result?.id) loadedSkillIds.add(result.id);
+        return ok(result);
       }
       case 'list': {
         if (!getState().projectId) throw new Error('No active project. Call project(action="open") first.');
@@ -1527,13 +1604,17 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
         const { skillId } = args;
         if (!skillId) throw new Error('skillId required for action=attach');
         if (!getState().projectId) throw new Error('No active project. Call project(action="open") first.');
-        return ok(await api('POST', `/api/projects/${getState().projectId}/skills`, { skillId }));
+        const result = await api('POST', `/api/projects/${getState().projectId}/skills`, { skillId });
+        invalidateProjectSkillsCache(getState().projectId);
+        return ok(result);
       }
       case 'detach': {
         const { skillId } = args;
         if (!skillId) throw new Error('skillId required for action=detach');
         if (!getState().projectId) throw new Error('No active project. Call project(action="open") first.');
-        return ok(await api('DELETE', `/api/projects/${getState().projectId}/skills/${skillId}`));
+        const result = await api('DELETE', `/api/projects/${getState().projectId}/skills/${skillId}`);
+        invalidateProjectSkillsCache(getState().projectId);
+        return ok(result);
       }
       case 'favorite': {
         const { skillId } = args;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.1.4",
+  "version": "1.2.0",
   "description": "Drafted CLI - Design preview server for Claude agents",
   "type": "module",
   "files": [