drafted 1.11.17 → 1.11.18

package/mcp/server.mjs

@@ -766,6 +766,23 @@ async function api(method, path, body, extraHeaders = {}, _retried = false) {
   const scopedPath = pid ? `${path}${sep}projectId=${pid}` : path;
   const url = `${getServerUrl()}${scopedPath}`;
   const headers = { ...getAuthHeaders(), ...extraHeaders };
+  // Bind every data request to the org this MCP session is actually working in
+  // (the active project's org, or the org chosen via get_org switch). Without
+  // this, project-scoped routes that resolve org from the SHARED server-side
+  // session row (notably /api/fs ls + frame read, via effectiveOrgId) break when
+  // a concurrent agent session for the same user flips that row to another org:
+  // the active project then "isn't in the current org", the 404 handler below
+  // clears it, and the agent sees the "active project no longer in the current
+  // org" churn. X-Drafted-Org is validated against the caller's memberships
+  // server-side and never mutates the session, so it scopes resolution
+  // per-request — exactly like the org-less /project/:slug link that already
+  // works. An explicit override in extraHeaders (e.g. the wiki/skill `org` arg)
+  // always wins, and /auth/* is left untouched so it reports true session state.
+  const boundOrg = getSessionState().boundOrgId;
+  const hasExplicitOrg = Object.keys(headers).some((k) => k.toLowerCase() === 'x-drafted-org');
+  if (boundOrg && !hasExplicitOrg && !path.startsWith('/auth/')) {
+    headers['X-Drafted-Org'] = boundOrg;
+  }
   const opts = { method, headers };
 
   if (body !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.17",
+  "version": "1.11.18",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [