drafted 1.11.24 → 1.11.26

package/mcp/server.mjs

@@ -1138,6 +1138,18 @@ async function requireBoundOrgForProjectlessMutation(explicitOrg) {
   const sess = getSessionState();
   if (sess.boundOrgId) return;            // bound via project open / get_org switch
   if (getState().projectId) return;        // an active project implies its org
+  // Remote/web sessions are isolated per connection: each one gets its OWN
+  // server-side session row with its own org_id set on connect, so the session
+  // org IS this session's binding — there's no shared, long-lived session to
+  // confuse here the way stdio has. Adopt that org automatically instead of
+  // forcing the agent to call get_org switch / project open before a project-less
+  // wiki or skill write. The DRAFT-36 Phase 4 "refuse to guess" guard below
+  // therefore applies to stdio only.
+  if (isRemote) {
+    const ctx = await getCurrentOrgContext();
+    if (ctx?.id) sess.boundOrgId = ctx.id;
+    return;
+  }
   let count = sess.cachedOrgCount;
   if (count == null) {
     try {
@@ -1406,6 +1418,7 @@ tool('project', 'START HERE for project management. Dispatch by `action`: list (
   name: z.string().optional().describe('[create|update] project name'),
   description: z.string().nullable().optional().describe('[create|update] project description'),
   templateSlug: z.string().optional().describe('[create] template slug (e.g. "web-design", "mobile-app", "landing-page")'),
+  org: z.string().optional().describe('[create] org slug or id to create the project in, without switching the session. Defaults to the bound/active org.'),
   folder: z.string().nullable().optional().describe('[update] folder name (null to remove from folder)'),
   layers: z.array(z.object({}).passthrough()).optional().describe('[update] full layers array replacement. Use ls / to read current layers first.'),
   targetOrgId: z.string().optional().describe('[move] destination organization ID. Get org IDs from action=list (each project has an orgId field) or get_org. Both source and target org must include the current user.'),
@@ -1529,12 +1542,14 @@ tool('project', 'START HERE for project management. Dispatch by `action`: list (
       case 'create': {
         const g3 = g3Block(getSessionState().gates);
         if (g3) return err(new Error(g3));
-        const { name, description, templateSlug } = args;
+        const { name, description, templateSlug, org } = args;
         if (!name) throw new Error('name required for action=create');
         const body = { name };
         if (description) body.description = description;
         if (templateSlug) body.templateSlug = templateSlug;
-        return ok(withProjectBreadcrumb(await api('POST', '/api/projects', body)));
+        // `org` targets a specific org without switching the session cursor.
+        const createExtra = org ? { 'X-Drafted-Org': org } : {};
+        return ok(withProjectBreadcrumb(await api('POST', '/api/projects', body, createExtra)));
       }
       case 'update': {
         const { projectId, name, folder, description, layers } = args;
@@ -2947,8 +2962,11 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
     const { action } = args;
     // Org-creating/editing skill actions on the project-less surface must have a
     // bound org (or explicit org=) when the user is multi-org. (DRAFT-36 Phase 4.)
+    // UUID-first exception: update/remove addressed by a skillId derive their org
+    // from the skill row server-side, so the bound-org gate is unnecessary.
     if (['add', 'update', 'remove', 'push', 'fork'].includes(action)) {
-      await requireBoundOrgForProjectlessMutation(args.org);
+      const byId = (action === 'update' || action === 'remove') && /^[a-f0-9-]{36}$/.test(args.skillId || '');
+      if (!byId) await requireBoundOrgForProjectlessMutation(args.org);
     }
     switch (action) {
       case 'search': {
@@ -3155,6 +3173,8 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
 tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and other agents/humans share maintenance — every edit broadcasts live, and edits from others appear in `recent` and on `read`.\n\n**Wiki always operates on the ACTIVE org.** If the content you need lives in a different org, switch first via `get_org(action="switch", orgId=...)` — don\'t assume "no hits" means the content doesn\'t exist. Verify the active org with `get_org` before searching.\n\nBefore mutating: check `recent` and `search` for relevant existing pages. Before mv/rm: check `links` (or pass `dryRun=true`). After completing a logical session of work, append a `log` entry.\n\nThe tool handles bookkeeping you\'d otherwise forget: `mv` rewrites inbound references via the link index, `read` shows who edited last and when. Use `health` to find unlinked pages and broken links.\n\n**Skill gate:** the org may attach a `wiki-maintainer` skill that you MUST load before mutations. If you get a skill-gate error, run skill(action="load", skill="wiki-maintainer") then retry.', {
   action: z.enum(['ls', 'recent', 'read', 'search', 'links', 'log', 'health', 'write', 'edit', 'mv', 'rm', 'source-register', 'source-list', 'source-get', 'bulk-write']).describe('Operation to perform.'),
   path: z.string().optional().describe('[ls|read|links] wiki path. For ls: default / (root). For read: required. For links: required.'),
+  pageId: z.string().optional().describe('[read|edit|mv|rm|links] page UUID (from read/search). UUID-first: addresses the page directly, org auto-derives — no org needed and no path lookup. Preferred over path for an existing page.'),
+  org: z.string().optional().describe('[write] org slug or id to create/target the page in, without switching the session. Required to create a page when you belong to more than one org and none is bound.'),
   recursive: z.boolean().optional().describe('[ls] list recursively with depth indicators'),
   limit: z.number().optional().describe('[recent|search] max results (recent default 10, search default 25)'),
   query: z.string().optional().describe('[search] term to search in title, path, and content'),
@@ -3184,10 +3204,13 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
   try {
     const { action } = args;
 
-    // Project-less wiki mutations must have a bound org when the user is
-    // multi-org, so a write never silently lands in an inherited org. (Ph4.)
+    // UUID-first: a `pageId` (edit/mv/rm) or an explicit `org` (write) makes the
+    // target org unambiguous, so the bound-org gate is unnecessary — skip it.
+    // Otherwise (path-addressed, multi-org, nothing bound) the gate still
+    // refuses to guess the org so a write never silently lands in the wrong one.
+    const orgHeader = args.org ? { 'X-Drafted-Org': args.org } : {};
     if (['write', 'edit', 'mv', 'rm', 'bulk-write'].includes(action)) {
-      await requireBoundOrgForProjectlessMutation(undefined);
+      if (!args.pageId) await requireBoundOrgForProjectlessMutation(args.org);
     }
 
     // Resolve org context once for the wiki tool. Each MCP session is bound
@@ -3288,22 +3311,29 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
       // Returns content in hashline format (`LINE+ID|content`) so the
       // agent can produce hashline edit operations. Mirrors frame.read.
       case 'read': {
-        const { path: readPath, lines: readLines } = args;
-        if (!readPath) throw new Error('path required for action=read');
-        const normalized = normalizeWikiPath(readPath);
-        const params = new URLSearchParams({ path: normalized, format: 'hashline' });
-        if (readLines) {
-          if (!/^\d+-\d+$/.test(readLines)) throw new Error(`lines must be "N-M" (e.g. "10-50"), got: ${readLines}`);
-          params.set('lines', readLines);
+        const { path: readPath, pageId: readPageId, lines: readLines } = args;
+        if (readLines && !/^\d+-\d+$/.test(readLines)) throw new Error(`lines must be "N-M" (e.g. "10-50"), got: ${readLines}`);
+        let page;
+        if (readPageId) {
+          // UUID-first: address the page directly, org auto-derives server-side.
+          const params = new URLSearchParams({ format: 'hashline' });
+          if (readLines) params.set('lines', readLines);
+          page = await api('GET', `/api/wiki/pages/${readPageId}?${params.toString()}`);
+        } else {
+          if (!readPath) throw new Error('path or pageId required for action=read');
+          const normalized = normalizeWikiPath(readPath);
+          const params = new URLSearchParams({ path: normalized, format: 'hashline' });
+          if (readLines) params.set('lines', readLines);
+          page = await api('GET', `/api/wiki/page?${params.toString()}`, undefined, orgHeader);
         }
-        const page = await api('GET', `/api/wiki/page?${params.toString()}`);
         // Get backlink count via search (approximate)
         let backlinkCount = 0;
         try {
-          const searchRes = await api('GET', `/api/wiki/search?q=${encodeURIComponent(normalized)}`);
+          const searchRes = await api('GET', `/api/wiki/search?q=${encodeURIComponent(page.path)}`, undefined, orgHeader);
           backlinkCount = (searchRes.hits || []).length;
         } catch { /* best-effort */ }
         return ok({
+          id: page.id,
           path: page.path,
           title: page.title,
           type: page.type,
@@ -3321,19 +3351,23 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
       case 'search': {
         const { query: searchQuery, limit: searchLimit = 25 } = args;
         if (!searchQuery) throw new Error('query required for action=search');
-        const result = await api('GET', `/api/wiki/search?q=${encodeURIComponent(searchQuery)}&limit=${searchLimit}`);
-        const hits = (result.hits || []).map(h => ({ path: h.path, title: h.title, url: wikiBrowserUrl(h.path) }));
+        const result = await api('GET', `/api/wiki/search?q=${encodeURIComponent(searchQuery)}&limit=${searchLimit}`, undefined, orgHeader);
+        // Surface pageId so the agent can re-address the page by UUID (org-free).
+        const hits = (result.hits || []).map(h => ({ id: h.id, path: h.path, title: h.title, url: wikiBrowserUrl(h.path) }));
         markSearched(getSessionState().gates, 'wiki');
         return ok({ hits });
       }
 
       // ── links ───────────────────────────────────────────────────
       case 'links': {
-        const { path: linksPath } = args;
-        if (!linksPath) throw new Error('path required for action=links');
-        const normalized = normalizeWikiPath(linksPath);
-        const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`);
-        return ok(await api('GET', `/api/wiki/pages/${page.id}/links`));
+        const { path: linksPath, pageId: linksPageId } = args;
+        let id = linksPageId;
+        if (!id) {
+          if (!linksPath) throw new Error('path or pageId required for action=links');
+          const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalizeWikiPath(linksPath))}`, undefined, orgHeader);
+          id = page.id;
+        }
+        return ok(await api('GET', `/api/wiki/pages/${id}/links`));
       }
 
       // ── log ─────────────────────────────────────────────────────
@@ -3383,13 +3417,14 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
         if (writeType) body.type = writeType;
         if (frontmatter !== undefined) body.frontmatter = frontmatter;
 
-        // Check if page exists — if so, update; otherwise create
+        // Check if page exists — if so, update; otherwise create. `orgHeader`
+        // (the `org` arg) targets a specific org without switching the session.
         try {
-          const existing = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`);
-          const result = await api('PATCH', `/api/wiki/pages/${existing.id}`, body);
+          const existing = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`, undefined, orgHeader);
+          const result = await api('PATCH', `/api/wiki/pages/${existing.id}`, body, orgHeader);
           return ok(withOrg({ path: result.path, title: result.title, id: result.id, updated: true, url: wikiBrowserUrl(result.path) }));
         } catch {
-          const result = await api('POST', '/api/wiki/pages', body);
+          const result = await api('POST', '/api/wiki/pages', body, orgHeader);
           return ok(withOrg({ path: result.path, title: result.title, id: result.id, created: true, url: wikiBrowserUrl(result.path) }));
         }
       }
@@ -3417,50 +3452,61 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
         });
       }
       case 'edit': {
-        const { path: editPath, operations: editOps } = args;
-        if (!editPath) throw new Error('path required for action=edit');
+        const { path: editPath, pageId: editPageId, operations: editOps } = args;
         if (!Array.isArray(editOps) || editOps.length === 0) throw new Error('operations (array) required for action=edit');
-        const normalized = normalizeWikiPath(editPath);
-        const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`);
-        const result = await api('POST', `/api/wiki/pages/${page.id}/edit`, { operations: editOps });
+        let id = editPageId;
+        if (!id) {
+          if (!editPath) throw new Error('path or pageId required for action=edit');
+          const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalizeWikiPath(editPath))}`, undefined, orgHeader);
+          id = page.id;
+        }
+        const result = await api('POST', `/api/wiki/pages/${id}/edit`, { operations: editOps });
         return ok(withOrg({ path: result.path, id: result.id, updated: true, applied: result.applied, url: wikiBrowserUrl(result.path) }));
       }
 
       // ── mv ──────────────────────────────────────────────────────
       case 'mv': {
-        const { from: mvFrom, to: mvTo, dryRun: mvDryRun = false } = args;
-        if (!mvFrom) throw new Error('from (source path) required for action=mv');
+        const { from: mvFrom, to: mvTo, pageId: mvPageId, dryRun: mvDryRun = false } = args;
         if (!mvTo) throw new Error('to (destination path) required for action=mv');
-        const fromPath = normalizeWikiPath(mvFrom);
         const toPath = normalizeWikiPath(mvTo);
-        if (fromPath === toPath) throw new Error('source and destination are the same');
-
-        const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(fromPath)}`);
+        let id = mvPageId;
+        if (!id) {
+          if (!mvFrom) throw new Error('from (source path) or pageId required for action=mv');
+          const fromPath = normalizeWikiPath(mvFrom);
+          if (fromPath === toPath) throw new Error('source and destination are the same');
+          const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(fromPath)}`, undefined, orgHeader);
+          id = page.id;
+        }
 
         if (mvDryRun) {
-          const { referrers } = await api('GET', `/api/wiki/pages/${page.id}/referrers`);
+          const { referrers } = await api('GET', `/api/wiki/pages/${id}/referrers`);
           return ok(withOrg({ impacted: referrers.map(r => ({ path: r.path, title: r.title })) }));
         }
 
         // Server-side cascade: /move rewrites referrers in one transaction
-        const moved = await api('PATCH', `/api/wiki/pages/${page.id}/move`, { path: toPath });
+        const moved = await api('PATCH', `/api/wiki/pages/${id}/move`, { path: toPath });
         return ok(withOrg({ path: moved.path, title: moved.title, id: moved.id, referrersUpdated: moved.referrersUpdated ?? 0, url: wikiBrowserUrl(moved.path) }));
       }
 
       // ── rm ──────────────────────────────────────────────────────
       case 'rm': {
-        const { path: rmPath, dryRun: rmDryRun = false } = args;
-        if (!rmPath) throw new Error('path required for action=rm');
-        const normalized = normalizeWikiPath(rmPath);
-        const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`);
-        const { referrers } = await api('GET', `/api/wiki/pages/${page.id}/referrers`);
+        const { path: rmPath, pageId: rmPageId, dryRun: rmDryRun = false } = args;
+        let id = rmPageId;
+        let normalized = null;
+        if (!id) {
+          if (!rmPath) throw new Error('path or pageId required for action=rm');
+          normalized = normalizeWikiPath(rmPath);
+          const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`, undefined, orgHeader);
+          id = page.id;
+        }
+        const { referrers } = await api('GET', `/api/wiki/pages/${id}/referrers`);
         const broken = referrers.map(r => ({ path: r.path, title: r.title }));
 
         if (rmDryRun) {
           return ok(withOrg({ brokenAfterDelete: broken }));
         }
-        await api('DELETE', `/api/wiki/pages/${page.id}`);
-        return ok(withOrg({ deleted: true, path: normalized, id: page.id, brokenReferences: broken }));
+        await api('DELETE', `/api/wiki/pages/${id}`);
+        return ok(withOrg({ deleted: true, path: normalized, id, brokenReferences: broken }));
       }
 
       // ── bulk-write ──────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.24",
+  "version": "1.11.26",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [