drafted 1.11.12 → 1.11.14

package/agent-instructions/global.md

@@ -29,6 +29,8 @@ Skill rules:
 - Search skills before starting repeatable work: skill(action="search") or skill(action="list").
 - Load and follow relevant skills with skill(action="load"). Read supporting skill files when needed.
 - When the user asks to record, distill, create, save, install, or update a skill/procedure/SOP/checklist/method/protocol/playbook, create or update a Drafted skill for the org with skill tools.
+- Every skill has a portable part — its method, SKILL.md, and any script source — and that part always belongs in Drafted, not only in a local repo. When you build a runnable skill, push the source to Drafted (skill action="push", or skill action="add" for prose) and declare how to rebuild it in the skill's `setup:` frontmatter (e.g. ["npm ci"]) so any machine or agent can regenerate it. Do not leave a reusable skill authored only as local files when Drafted is connected.
+- Machine-specific build output (node_modules, downloaded browsers, compiled binaries) is never portable: build it into a `.skillinstall/` directory inside the skill. Drafted always strips `.skillinstall/` from a pushed bundle and skill push auto-gitignores it, so the rebuildable bundle stays local while the method and recipe stay in Drafted.
 - Improve skills when you find a better checklist, standard, or operating method.
 
 Project/producible rules:

package/cli/drafted.mjs

@@ -1828,7 +1828,7 @@ skillCmd
 function collectSkillTree(dir) {
   const root = resolve(dir);
   if (!existsSync(root) || !statSync(root).isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const SKIP_DIRS = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform']);
+  const SKIP_DIRS = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform', '.skillinstall']);
   let ignore = () => false;
   const ignPath = join(root, '.skillignore');
   if (existsSync(ignPath)) {
@@ -1854,9 +1854,25 @@ function collectSkillTree(dir) {
   return out;
 }
 
+// Ensure the pushed source tree's .gitignore excludes the rebuildable bundle dir,
+// so a skill's machine-specific build output (built into .skillinstall/ by its
+// `setup:` recipe) can never be committed. The server already strips .skillinstall/
+// from the bundle (skill-ingest DENY_DIRS) — this keeps the author's git clean too.
+// Idempotent; returns true only when it adds the entry.
+function ensureSkillInstallIgnored(dir) {
+  try {
+    const gi = join(dir, '.gitignore');
+    const existing = existsSync(gi) ? readFileSync(gi, 'utf8') : '';
+    if (existing.split(/\r?\n/).some((l) => l.trim().replace(/\/$/, '') === '.skillinstall')) return false;
+    const body = existing && !existing.endsWith('\n') ? existing + '\n' : existing;
+    writeFileSync(gi, body + '.skillinstall/\n');
+    return true;
+  } catch { return false; }
+}
+
 skillCmd
   .command('push')
-  .description('Push a local source tree into a skill (bulk ingest; server strips artifacts + enforces caps)')
+  .description('Push a local source tree into a Drafted skill (bulk ingest). Stores the portable bits — SKILL.md, scripts, and the setup: recipe; build output is stripped server-side. Build machine-specific output into .skillinstall/ (auto-gitignored, always stripped) and declare its rebuild in setup:.')
   .option('--id <id>', 'skill id')
   .option('--slug <slug>', 'skill slug (resolved to id)')
   .requiredOption('--dir <dir>', 'local source tree to push')
@@ -1878,8 +1894,137 @@ skillCmd
     });
     const data = await res.json().catch(() => ({}));
     if (!res.ok) { emitSkillResult(opts.format, { status: 'error', id, error: data.error || `HTTP ${res.status}` }); process.exit(1); }
-    if (opts.format === 'json') console.log(JSON.stringify({ status: 'ok', id, hash: data.hash, count: data.count, stripped: data.stripped, files: data.files }));
-    else console.log(`ok\t${id}\t${data.hash}\tpushed ${data.count}${data.stripped ? `, stripped ${data.stripped}` : ''}`);
+    const gitignored = ensureSkillInstallIgnored(opts.dir);
+    if (opts.format === 'json') console.log(JSON.stringify({ status: 'ok', id, hash: data.hash, count: data.count, stripped: data.stripped, gitignored, files: data.files }));
+    else console.log(`ok\t${id}\t${data.hash}\tpushed ${data.count}${data.stripped ? `, stripped ${data.stripped}` : ''}${gitignored ? ', gitignored .skillinstall/' : ''}`);
+  });
+
+// ── Collectors: management seam (parity with the MCP `collector` tool) ──
+// Collectors are checklist-driven intake surfaces. Management is behind the
+// agent allowlist (same gate as Minion) and scoped to the session's active org.
+function emitCollectorResult(format, obj) {
+  if (format === 'json') { console.log(JSON.stringify(obj)); return; }
+  console.log([obj.status, obj.id || '', obj.slug || '', obj.name || '', obj.error || ''].join('\t'));
+}
+
+async function collectorSetEnabled(id, enabled, format) {
+  requireLogin();
+  const server = getServerUrl().replace(/\/$/, '');
+  const res = await authFetch(`${server}/api/collectors/${encodeURIComponent(id)}`, {
+    method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ enabled }),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) { emitCollectorResult(format, { status: res.status === 404 ? 'not-found' : 'error', error: data.error || `HTTP ${res.status}` }); process.exit(1); }
+  const c = data.collector || {};
+  emitCollectorResult(format, { status: 'ok', id: c.id, slug: c.slug, name: c.name });
+}
+
+const collectorCmd = program.command('collector').description('Collector management (checklist-driven intake surfaces). Requires the agent allowlist.');
+
+collectorCmd
+  .command('list')
+  .description('List collectors (scoped to --project or your active project; all org collectors if neither)')
+  .option('--project <id>', 'project to scope to (defaults to your active project)')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    const pid = opts.project || getActiveProject()?.id;
+    const data = await readApiGet('collector:list', withQuery('/api/collectors', { projectId: pid }));
+    const rows = data.collectors || [];
+    if (opts.format === 'json') { console.log(JSON.stringify(rows)); return; }
+    for (const c of rows) console.log(`${c.id}\t${c.slug}\t${c.enabled ? 'enabled' : 'disabled'}\t${c.name}`);
+  });
+
+collectorCmd
+  .command('get <id>')
+  .description('Get a collector by id')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (id, opts) => {
+    const data = await readApiGet('collector:get', `/api/collectors/${encodeURIComponent(id)}`);
+    if (opts.format === 'json') { console.log(JSON.stringify(data.collector || data)); return; }
+    const c = data.collector || {};
+    console.log(`${c.id}\t${c.slug}\t${c.enabled ? 'enabled' : 'disabled'}\t${c.name}`);
+  });
+
+collectorCmd
+  .command('meta')
+  .description('Project layers/lanes/frames for building a collector target/output')
+  .option('--project <id>', 'project (defaults to your active project)')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    const pid = opts.project || getActiveProject()?.id;
+    if (!pid) { console.error('No active project. Pass --project <id> or run `drafted use <project>`.'); process.exit(1); }
+    const data = await readApiGet('collector:meta', withQuery('/api/collectors/meta', { projectId: pid }));
+    console.log(JSON.stringify(data));
+  });
+
+collectorCmd
+  .command('create')
+  .description('Create a collector from stdin JSON {name,description?,target,checklist,output,enabled?}')
+  .option('--project <id>', 'project to bind to (defaults to your active project)')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    requireLogin();
+    const pid = opts.project || getActiveProject()?.id;
+    if (!pid) { emitCollectorResult(opts.format, { status: 'error', error: 'no project — pass --project <id> or run `drafted use <project>`' }); process.exit(1); }
+    let p;
+    try { p = readStdinJSON(); } catch { console.error('invalid JSON on stdin'); process.exit(1); }
+    const server = getServerUrl().replace(/\/$/, '');
+    const res = await authFetch(`${server}/api/collectors`, {
+      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ projectId: pid, name: p.name, description: p.description, target: p.target, checklist: p.checklist, output: p.output, enabled: p.enabled }),
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) { emitCollectorResult(opts.format, { status: res.status === 403 ? 'forbidden' : 'error', error: data.error || `HTTP ${res.status}` }); process.exit(1); }
+    const c = data.collector || {};
+    emitCollectorResult(opts.format, { status: 'ok', id: c.id, slug: c.slug, name: c.name });
+  });
+
+collectorCmd
+  .command('update <id>')
+  .description('Update a collector from stdin JSON {name?,description?,target?,checklist?,output?,enabled?}')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (id, opts) => {
+    requireLogin();
+    let p;
+    try { p = readStdinJSON(); } catch { console.error('invalid JSON on stdin'); process.exit(1); }
+    const body = {};
+    for (const k of ['name', 'description', 'target', 'checklist', 'output', 'enabled']) {
+      if (p[k] !== undefined) body[k] = p[k];
+    }
+    if (Object.keys(body).length === 0) { emitCollectorResult(opts.format, { status: 'error', error: 'no fields to update' }); process.exit(1); }
+    const server = getServerUrl().replace(/\/$/, '');
+    const res = await authFetch(`${server}/api/collectors/${encodeURIComponent(id)}`, {
+      method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) { emitCollectorResult(opts.format, { status: res.status === 404 ? 'not-found' : 'error', error: data.error || `HTTP ${res.status}` }); process.exit(1); }
+    const c = data.collector || {};
+    emitCollectorResult(opts.format, { status: 'ok', id: c.id, slug: c.slug, name: c.name });
+  });
+
+collectorCmd
+  .command('enable <id>')
+  .description('Make a collector live')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action((id, opts) => collectorSetEnabled(id, true, opts.format));
+
+collectorCmd
+  .command('disable <id>')
+  .description('Take a collector offline')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action((id, opts) => collectorSetEnabled(id, false, opts.format));
+
+collectorCmd
+  .command('delete <id>')
+  .description('Delete a collector (past submissions are kept as history)')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (id, opts) => {
+    requireLogin();
+    const server = getServerUrl().replace(/\/$/, '');
+    const res = await authFetch(`${server}/api/collectors/${encodeURIComponent(id)}`, { method: 'DELETE' });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) { emitCollectorResult(opts.format, { status: res.status === 404 ? 'not-found' : 'error', error: data.error || `HTTP ${res.status}` }); process.exit(1); }
+    emitCollectorResult(opts.format, { status: 'ok', id: data.id || id });
   });
 
 program.parse();

package/install-mcp.sh

@@ -443,6 +443,8 @@ Skill rules:
 - Search skills before starting repeatable work: skill(action="search") or skill(action="list").
 - Load and follow relevant skills with skill(action="load"). Read supporting skill files when needed.
 - When the user asks to record, distill, create, save, install, or update a skill/procedure/SOP/checklist/method/protocol/playbook, create or update a Drafted skill for the org with skill tools.
+- Every skill has a portable part — its method, SKILL.md, and any script source — and that part always belongs in Drafted, not only in a local repo. When you build a runnable skill, push the source to Drafted (skill action="push", or skill action="add" for prose) and declare how to rebuild it in the skill's `setup:` frontmatter (e.g. ["npm ci"]) so any machine or agent can regenerate it. Do not leave a reusable skill authored only as local files when Drafted is connected.
+- Machine-specific build output (node_modules, downloaded browsers, compiled binaries) is never portable: build it into a `.skillinstall/` directory inside the skill. Drafted always strips `.skillinstall/` from a pushed bundle and skill push auto-gitignores it, so the rebuildable bundle stays local while the method and recipe stay in Drafted.
 - Improve skills when you find a better checklist, standard, or operating method.
 
 Project/producible rules:

package/mcp/server.mjs

@@ -139,6 +139,7 @@ const REMOTE_JSON_STRING_PARAMS = {
   wiki: ['frontmatter', 'pages'],
   project: ['layers'],
   template: ['layers'],
+  collector: ['target', 'checklist', 'output'],
 };
 
 // Remove sentences that reference local-file params from a tool description,
@@ -242,6 +243,9 @@ const TOOL_ANNOTATIONS = {
   // Skills
   skill:               { title: 'Skills',              readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Manage the Drafted skill library: search, load, add, update, remove, attach/detach from projects, favorite, and edit skill files.' },
   wiki:                { title: 'Wiki',                readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Per-org wiki. Markdown pages with paths as hierarchy. Dispatch by `action`.' },
+
+  // Collectors — checklist-driven, Minion-run intake surfaces bound to a project
+  collector:           { title: 'Collectors',          readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Manage Collectors: checklist-driven intake surfaces that guide a consumer through a checklist (via a shareable /c/<slug> link) and then write a producible into the project. Dispatch by `action`: meta (discover layers/lanes/frames), list, get, create, update, enable, disable, delete. Requires the agent allowlist (same gate as Minion).' },
 };
 
 function isMutatingToolCall(name, args = {}) {
@@ -267,6 +271,8 @@ function isMutatingToolCall(name, args = {}) {
       return ['add', 'update', 'remove', 'attach', 'detach', 'favorite', 'unfavorite', 'update_file'].includes(action);
     case 'wiki':
       return ['log', 'write', 'edit', 'mv', 'rm', 'source-register', 'bulk-write'].includes(action);
+    case 'collector':
+      return ['create', 'update', 'enable', 'disable', 'delete'].includes(action);
     case 'rm':
     case 'shape':
     case 'group':
@@ -361,7 +367,7 @@ function tool(name, descOrSchema, schemaOrHandler, handler) {
           const v = args[0][k];
           if (typeof v === 'string' && v.trim()) {
             try { args[0][k] = JSON.parse(v); }
-            catch { return err(new Error(`Param "${k}" must be a JSON-encoded ${k === 'excalidraw_data' || k === 'frontmatter' ? 'object' : 'array'} string; JSON.parse failed.`)); }
+            catch { return err(new Error(`Param "${k}" must be a JSON-encoded ${['excalidraw_data', 'frontmatter', 'target', 'output'].includes(k) ? 'object' : 'array'} string; JSON.parse failed.`)); }
           }
         }
       }
@@ -2751,7 +2757,7 @@ tool('layout', 'Auto-arrange frames using graph layout algorithm. Positions conn
 function collectSkillTreeForPush(dir) {
   const root = resolve(dir);
   if (!existsSync(root) || !statSync(root).isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const SKIP = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform']);
+  const SKIP = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform', '.skillinstall']);
   const NUL = String.fromCharCode(0);
   let ignore = () => false;
   const ign = join(root, '.skillignore');
@@ -2778,7 +2784,22 @@ function collectSkillTreeForPush(dir) {
   return out;
 }
 
-tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/guidelines agents can load and follow. Dispatch by `action`: search/load/list for discovery; history for a skill\'s version git-log; add/update/remove for org skills; fork/push for source-only skills; attach/detach for project binding; favorite/unfavorite for personal pins; read_file/update_file for supporting files inside a skill directory.', {
+// Ensure a pushed source tree's .gitignore excludes the rebuildable bundle dir, so
+// a skill's machine-specific build output (built into .skillinstall/ by its `setup:`
+// recipe) can never be committed. The server also strips .skillinstall/ from the
+// bundle (skill-ingest DENY_DIRS); this keeps the author's git clean. Idempotent.
+function ensureSkillInstallIgnored(dir) {
+  try {
+    const gi = join(dir, '.gitignore');
+    const existing = existsSync(gi) ? readFileSync(gi, 'utf8') : '';
+    if (existing.split(/\r?\n/).some((l) => l.trim().replace(/\/$/, '') === '.skillinstall')) return false;
+    const body = existing && !existing.endsWith('\n') ? existing + '\n' : existing;
+    writeFileSync(gi, body + '.skillinstall/\n');
+    return true;
+  } catch { return false; }
+}
+
+tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/guidelines agents can load and follow. When you build a reusable skill, author it HERE — add for prose, push to ingest a local source tree — so its method and setup: recipe live in Drafted and any machine or agent can reuse it; keep only machine-specific build output local in .skillinstall/ (always stripped on push). Dispatch by `action`: search/load/list for discovery; history for a skill\'s version git-log; add/update/remove for org skills; fork/push for source-only skills; attach/detach for project binding; favorite/unfavorite for personal pins; read_file/update_file for supporting files inside a skill directory.', {
   action: z.enum([
     'search', 'load', 'list', 'history',
     'add', 'update', 'remove',
@@ -2805,7 +2826,7 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
   org: z.string().optional().describe('[fork|push|update] resolve/fork into this Drafted org (id or name); scopes the request without switching the session'),
   setup: z.array(z.string()).optional().describe('[add|update] setup command(s) (in order) run on materialize to build a source-only skill, e.g. ["npm ci","npm run build"]'),
   files: z.array(z.object({ path: z.string(), content: z.string() })).optional().describe('[push] source files to push (path + UTF-8 content); server strips artifacts + enforces caps'),
-  dir: z.string().optional().describe('[push] local directory to push instead of files[]; walked locally (heavy dirs + .skillignore pre-filtered), server re-enforces'),
+  dir: z.string().optional().describe('[push] local directory to push instead of files[]; walked locally (heavy dirs, .skillinstall/, and .skillignore pre-filtered), server re-enforces. On push the dir\'s .gitignore is auto-updated to exclude .skillinstall/ (the rebuildable bundle).'),
   deleteMissing: z.boolean().optional().describe('[push] remove stored files not present in the pushed set'),
 }, async (args) => {
   try {
@@ -2952,7 +2973,9 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
         let fileList = files;
         if (!fileList && dir) fileList = collectSkillTreeForPush(dir);
         if (!Array.isArray(fileList) || fileList.length === 0) throw new Error('files[] (non-empty) or dir required for action=push');
-        return ok(await api('POST', `/api/skills/${id}/files/bulk`, { files: fileList, deleteMissing: !!deleteMissing }, extra));
+        const pushed = await api('POST', `/api/skills/${id}/files/bulk`, { files: fileList, deleteMissing: !!deleteMissing }, extra);
+        if (dir) { try { if (ensureSkillInstallIgnored(dir)) pushed.gitignored = '.skillinstall/'; } catch { /* best-effort */ } }
+        return ok(pushed);
       }
       case 'attach': {
         const { skillId } = args;
@@ -3406,6 +3429,129 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
   } catch (error) { return err(error); }
 });
 
+// ── Collectors ────────────────────────────────────────────────────
+
+function compactCollectorEntry(c) {
+  if (!c || typeof c !== 'object') return c;
+  return { id: c.id, slug: c.slug, name: c.name, enabled: c.enabled, projectId: c.projectId };
+}
+
+// Shape a {collectors:[...]} list with limit/offset pagination + optional compact
+// mode, mirroring shapeSkillCatalog so large lists stay within token budget.
+function shapeCollectorList(result, { limit, offset = 0, compact = false } = {}) {
+  if (!Array.isArray(result?.collectors)) return result;
+  const total = result.collectors.length;
+  const start = Math.max(0, Math.floor(Number(offset) || 0));
+  const cap = Math.min(Math.max(1, Math.floor(Number(limit) || 25)), 100);
+  const page = result.collectors.slice(start, start + cap);
+  result.totalAvailable = total;
+  result.offset = start;
+  result.returned = page.length;
+  result.truncated = start + page.length < total;
+  result.collectors = compact ? page.map(compactCollectorEntry) : page;
+  result.note = compact
+    ? 'Compact list: {id,slug,name,enabled,projectId} only. Use collector(action="get", id="<id>") for full config; limit/offset to page.'
+    : 'Collectors are scoped to the active project (all org collectors when no project is open). Use limit/offset to page; compact=true for a leaner list.';
+  return result;
+}
+
+// Friendlier message when the agent allowlist gate (requireAgentAccess) rejects.
+function collectorGateError(e) {
+  if (e?.status === 403 || e?.code === 'agent_disabled') {
+    return new Error('Collector management is not enabled for this org/account (agent allowlist). Ask an admin to add your org or email to DRAFTED_AGENT_ALLOWED_ORGS / DRAFTED_AGENT_ALLOWED_EMAILS.');
+  }
+  return e;
+}
+
+tool('collector', {
+  action: z.enum(['meta', 'list', 'get', 'create', 'update', 'enable', 'disable', 'delete']).describe('Operation to perform.'),
+  id: z.string().optional().describe('[get|update|enable|disable|delete] collector ID (UUID)'),
+  projectId: z.string().optional().describe('[create|meta] project to bind/scope to (defaults to the active project). Operates on the session’s active org — open the target project first via project(action="open"), or get_org(action="switch") to change org.'),
+  name: z.string().optional().describe('[create|update] collector name'),
+  description: z.string().optional().describe('[create|update] one-line description shown to the consumer'),
+  enabled: z.boolean().optional().describe('[create|update] whether the collector is live; a disabled collector 404s on its /c/<slug> link. enable/disable set this directly.'),
+  target: z.object({
+    type: z.enum(['new-record', 'layer', 'frame']).describe('what the run writes against'),
+    layer: z.string().optional(),
+    frameId: z.string().optional(),
+  }).optional().describe('[create|update] where the run writes: a new record, into a layer, or updating a specific frame'),
+  checklist: z.array(z.object({
+    id: z.string().describe('stable item id'),
+    label: z.string().describe('what the consumer is asked for'),
+    description: z.string().optional(),
+    evidence: z.enum(['text', 'file', 'photo', 'none']).optional().describe('evidence required (default none)'),
+    required: z.boolean().optional(),
+  })).optional().describe('[create|update] ordered checklist the Minion guides the consumer through'),
+  output: z.object({
+    mode: z.enum(['generate', 'update', 'annotate']).describe('how the producible is written'),
+    layer: z.string().optional(),
+    lane: z.string().optional(),
+    filenameTemplate: z.string().optional().describe('e.g. "<id>.md"'),
+    skillSlug: z.string().optional().describe('skill that shapes the produced frame'),
+    grouping: z.string().optional().describe('"lane" gives each submission its own lane'),
+  }).optional().describe('[create|update] where/how the producible lands'),
+  limit: z.number().optional().describe('[list] max results per page (default 25, max 100)'),
+  offset: z.number().optional().describe('[list] skip N results for pagination (default 0)'),
+  compact: z.boolean().optional().describe('[list] return only {id,slug,name,enabled,projectId} per collector'),
+}, async (args) => {
+  try {
+    const { action } = args;
+    switch (action) {
+      case 'meta': {
+        const active = getState().projectId;
+        const pid = active || args.projectId;
+        if (!pid) throw new Error('No active project. Call project(action="open") first, or pass projectId.');
+        // api() auto-appends the active project; add projectId explicitly only when none is active.
+        const path = active ? '/api/collectors/meta' : `/api/collectors/meta?projectId=${encodeURIComponent(pid)}`;
+        return ok(await api('GET', path));
+      }
+      case 'list': {
+        // api() auto-appends the active project as ?projectId — so this lists the
+        // active project's collectors, or all org collectors when none is open.
+        const result = await api('GET', '/api/collectors');
+        return ok(shapeCollectorList(result, { limit: args.limit, offset: args.offset, compact: args.compact }));
+      }
+      case 'get': {
+        if (!args.id) throw new Error('id is required for action=get');
+        return ok(await api('GET', `/api/collectors/${args.id}`));
+      }
+      case 'create': {
+        // projectId lives in the BODY (the POST route reads body, ignores the query).
+        const projectId = args.projectId || getState().projectId;
+        if (!projectId) throw new Error('No active project. Call project(action="open") first, or pass projectId.');
+        const { name, description, target, checklist, output, enabled } = args;
+        if (!name || !target || !Array.isArray(checklist) || !output) {
+          throw new Error('name, target, checklist[], and output are required for action=create');
+        }
+        const body = { projectId, name, target, checklist, output };
+        if (description !== undefined) body.description = description;
+        if (enabled !== undefined) body.enabled = enabled;
+        return ok(await api('POST', '/api/collectors', body));
+      }
+      case 'update': {
+        if (!args.id) throw new Error('id is required for action=update');
+        const body = {};
+        for (const k of ['name', 'description', 'target', 'checklist', 'output', 'enabled']) {
+          if (args[k] !== undefined) body[k] = args[k];
+        }
+        if (Object.keys(body).length === 0) throw new Error('At least one field is required for action=update');
+        return ok(await api('PATCH', `/api/collectors/${args.id}`, body));
+      }
+      case 'enable':
+      case 'disable': {
+        if (!args.id) throw new Error(`id is required for action=${action}`);
+        return ok(await api('PATCH', `/api/collectors/${args.id}`, { enabled: action === 'enable' }));
+      }
+      case 'delete': {
+        if (!args.id) throw new Error('id is required for action=delete');
+        return ok(await api('DELETE', `/api/collectors/${args.id}`));
+      }
+      default:
+        throw new Error(`Unknown collector action: ${action}`);
+    }
+  } catch (error) { return err(collectorGateError(error)); }
+});
+
 // ── Resource: canvas info ─────────────────────────────────────────
 
 server.resource('info', 'drafted://info', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.12",
+  "version": "1.11.14",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [