drafted 1.14.10 → 1.14.12

package/mcp/server.mjs

@@ -180,8 +180,11 @@ function scrubLocalPathMentions(description) {
 // project is the one legitimately-kept addressing root, NOT the deleted session
 // cursor. Awareness of a surprising destination (e.g. a fork) comes from the
 // response receipt naming the org (orgEcho), not from hard-blocking the flow.
-export function projectlessMutationNeedsOrg({ explicitOrg, boundOrgId, activeProjectId, isRemote, orgCount }) {
-  if (explicitOrg || boundOrgId || activeProjectId || isRemote) return false;
+// A remote session is NOT an exemption: its session org is inherited (the user's default),
+// not chosen, so for a multi-org user it is exactly the guess this guard exists to refuse.
+// Single-org callers (remote or stdio) are unambiguous and proceed.
+export function projectlessMutationNeedsOrg({ explicitOrg, boundOrgId, activeProjectId, orgCount }) {
+  if (explicitOrg || boundOrgId || activeProjectId) return false;
   return (orgCount || 0) > 1;
 }
 
@@ -404,6 +407,14 @@ function tool(name, descOrSchema, schemaOrHandler, handler) {
           }
         }
       }
+      // Per-call project override (see withProjectOverride). Scoping happens here so
+      // every project-scoped tool gets it from one seam instead of each handler.
+      const ref = PROJECT_SCOPED_TOOLS.has(name) ? args?.[0]?.projectId : null;
+      if (ref) {
+        const meta = await resolveProjectRef(ref);
+        if (!meta) return err(new Error(`Project "${ref}" not found — pass a project UUID, slug, or name from project(action="list").`));
+        return await withProjectOverride(meta, () => cb(...args));
+      }
       return await cb(...args);
     } finally {
       state.currentTool = previousTool;
@@ -919,6 +930,17 @@ async function serverFetch(url, opts) {
   catch (e) { throw enrichFetchError(e, url); }
 }
 
+// The org this session is actually working in: an explicit switch, else the org of the
+// bound project (a project belongs to exactly one org, so it IS an address). Never the
+// server session's org — that one is INHERITED (a fresh session lands on the user's
+// default), and trusting it is what wrote a Beoflow-bound agent's wiki page into
+// Personal. Used both to address requests (X-Drafted-Org) and to echo where a write
+// landed, so the two can never disagree.
+function workingOrgId() {
+  const session = getSessionState();
+  return session.boundOrgId || session.activeProjectMeta?.orgId || getState().projectMeta?.orgId || null;
+}
+
 async function api(method, path, body, extraHeaders = {}, _retried = false) {
   await ensureSession();
   const pid = getState().projectId;
@@ -926,6 +948,11 @@ async function api(method, path, body, extraHeaders = {}, _retried = false) {
   const scopedPath = pid ? `${path}${sep}projectId=${pid}` : path;
   const url = `${getServerUrl()}${scopedPath}`;
   const headers = { ...getAuthHeaders(), ...extraHeaders };
+  // Declare an unbound session explicitly. Without this the server falls back to the
+  // user's SHARED active-project row (any browser tab or parallel agent can rewrite it)
+  // and a frame write silently succeeds in the WRONG project. Project-scoped routes
+  // fail closed on this header; org-scoped ones (wiki, skill, get_org) ignore it.
+  if (!pid) headers['X-Drafted-Project'] = 'none';
   // Bind every data request to the org this MCP session is actually working in
   // (the active project's org, or the org chosen via get_org switch). Without
   // this, project-scoped routes that resolve org from the SHARED server-side
@@ -938,7 +965,26 @@ async function api(method, path, body, extraHeaders = {}, _retried = false) {
   // per-request — exactly like the org-less /project/:slug link that already
   // works. An explicit override in extraHeaders (e.g. the wiki/skill `org` arg)
   // always wins, and /auth/* is left untouched so it reports true session state.
-  const boundOrg = getSessionState().boundOrgId;
+  // The bound project's org is as good an address as an explicit switch — and it's the
+  // one the projectless-mutation guard already credits. Send it when boundOrgId wasn't
+  // set (an open whose meta lacked orgId, or state rehydrated from an older on-disk
+  // entry), so an org-scoped write can never fall back to the session's inherited org.
+  // A bound project whose org we don't know yet (an open whose meta lacked orgId, or an
+  // older on-disk entry rehydrated at boot) leaves workingOrgId() null — and then an
+  // org-scoped write would resolve against the session's inherited org. Learn the org
+  // from the project itself, once. The /api/projects guard stops resolveProjectRef, which
+  // calls that endpoint, from recursing back into here.
+  if (pid && !workingOrgId() && !path.startsWith('/api/projects')) {
+    try {
+      const meta = await resolveProjectRef(pid);
+      if (meta?.orgId) {
+        const s = getSessionState();
+        s.boundOrgId = meta.orgId;
+        s.activeProjectMeta = s.activeProjectMeta || meta;
+      }
+    } catch { /* best-effort; the server derives org from ?projectId anyway */ }
+  }
+  const boundOrg = workingOrgId();
   const hasExplicitOrg = Object.keys(headers).some((k) => k.toLowerCase() === 'x-drafted-org');
   if (boundOrg && !hasExplicitOrg && !path.startsWith('/auth/')) {
     headers['X-Drafted-Org'] = boundOrg;
@@ -988,7 +1034,10 @@ async function api(method, path, body, extraHeaders = {}, _retried = false) {
     // a get_org switch), and now the project is invisible. Clear our
     // sticky reference so the next tool call doesn't append a stale
     // projectId to its URL — and tell the agent what happened.
-    if ((res.status === 404 || /project not found/i.test(msg)) && pid && getState().projectId === pid) {
+    // Only a PROJECT-not-found clears the binding. A bare 404 also means "frame not
+    // found" / "page not found" — clearing on those unbound the session mid-turn, and
+    // the next write fell through to the shared active-project row in another project.
+    if (/project not found/i.test(msg) && pid && getState().projectId === pid) {
       const meta = getState().projectMeta;
       getState().projectId = null;
       getState().projectMeta = null;
@@ -1161,6 +1210,55 @@ function setMcpActiveProject(projectId, meta = null) {
   }
 }
 
+// Resolve a project reference — UUID, slug, or name (case-insensitive) — to its meta.
+// Agents carry slugs in context ("ios-app-shell-re-ui"), not UUIDs; demanding a UUID
+// forced a frame-search dance just to name a project. Backs both project(action="open")
+// and the per-call `projectId` override below.
+// ponytail: process-lifetime cache, no TTL — a project rename goes stale until restart.
+// Add invalidation if renames ever become common.
+const projectRefCache = new Map();
+async function resolveProjectRef(ref) {
+  if (!ref) return null;
+  const hit = projectRefCache.get(ref);
+  if (hit) return hit;
+  const data = await api('GET', '/api/projects');
+  const list = Array.isArray(data?.projects) ? data.projects : [];
+  const want = String(ref).toLowerCase();
+  const p =
+    list.find(x => x.id === ref) ||
+    list.find(x => String(x.slug || '').toLowerCase() === want) ||
+    list.find(x => String(x.name || '').toLowerCase() === want);
+  if (!p) return null;
+  const meta = { id: p.id, slug: p.slug || null, name: p.name || null, orgId: p.orgId || null, orgSlug: p.orgSlug || null };
+  projectRefCache.set(ref, meta);
+  projectRefCache.set(p.id, meta);
+  return meta;
+}
+
+// Run one tool call against a caller-named project WITHOUT rebinding the session.
+// The override lives in this call's AsyncLocalStorage frame only — request-local, so
+// it satisfies the DRAFT-36 addressing invariant (no shared, another-session-writable
+// resolution state) while giving a reconnected agent a way to address the project it
+// already knows, and to reach into another project for a one-off (e.g. deleting a
+// stray frame) without the open → act → re-open dance.
+function withProjectOverride(meta, fn) {
+  const base = getState();
+  return requestState.run(
+    { ...base, projectId: meta.id, projectMeta: meta, _session: base._session || getSessionState() },
+    fn,
+  );
+}
+
+// Tools that address frames/assets/layout inside ONE project. These accept the
+// per-call `projectId` override; everything else resolves org-side.
+const PROJECT_SCOPED_TOOLS = new Set(['frame', 'ls', 'rm', 'asset', 'connector', 'layout']);
+
+const PROJECT_OVERRIDE_PARAM = z.string().optional().describe(
+  'Target project (UUID, slug, or name) for THIS call only — does NOT rebind the session. ' +
+  'Use it when the session lost its binding (a reconnect), or to touch another project once ' +
+  'without re-opening it. Omit to use the project bound by project(action="open").',
+);
+
 // Returns { id, slug, name, orgId } for the project this MCP session most
 // recently opened — what frame mutations will actually target. Echoed on
 // every mutation so silent cross-project drift is visible.
@@ -1337,21 +1435,20 @@ async function requireBoundOrgForProjectlessMutation(explicitOrg) {
   if (explicitOrg) return;
   const sess = getSessionState();
   if (sess.boundOrgId) return;            // bound via project open (org = project's org)
-  if (getState().projectId) return;        // an active project implies its org
-  // Remote/web sessions are isolated per connection: each one gets its OWN
-  // server-side session row with its own org_id set on connect, so the session
-  // org IS this session's binding — there's no shared, long-lived session to
-  // confuse here the way stdio has. Adopt that org automatically instead of
-  // forcing the agent to open a project before a project-less
-  // wiki or skill write. The DRAFT-36 Phase 4 "refuse to guess" guard below
-  // therefore applies to stdio only.
-  if (isRemote) {
+  if (getState().projectId) return;        // an active project implies its org — api() now
+                                           // sends that project's org as X-Drafted-Org, so
+                                           // the org the guard credits is the org used
+  const orgs = await getOrgList();
+  if (!orgs.length) return; // can't determine membership — don't block a legit write
+  // A remote/web session does get its own server-side session row, but for a MULTI-ORG
+  // user the org on it is the one the connection INHERITED (the user's default), not one
+  // anybody chose — adopting it as a binding is how a Beoflow write landed in Personal.
+  // A single-org user is unambiguous, so keep the zero-friction path for them.
+  if (isRemote && orgs.length === 1) {
     const ctx = await getCurrentOrgContext();
     if (ctx?.id) sess.boundOrgId = ctx.id;
     return;
   }
-  const orgs = await getOrgList();
-  if (!orgs.length) return; // can't determine membership — don't block a legit write
   if (projectlessMutationNeedsOrg({ orgCount: orgs.length })) {
     throw new Error(
       `Refusing to guess the org: no project is open and no explicit org was ` +
@@ -1885,23 +1982,18 @@ tool('project', 'START HERE for project management. Dispatch by `action`: list (
         return ok(data, { structuredContent });
       }
       case 'open': {
-        const { projectId } = args;
-        if (!projectId) throw new Error('projectId required for action=open');
+        const ref = args.projectId;
+        if (!ref) throw new Error('projectId required for action=open (UUID, slug, or name)');
+        // Accept a slug or name, not just a UUID — the slug is what an agent actually has
+        // in context after a reconnect.
+        const resolved = await resolveProjectRef(ref).catch(() => null);
+        const projectId = resolved?.id || ref;
         const result = await api('POST', '/api/project/switch', { projectId });
         joinAgentWsRoom(projectId);
         const base = getServerUrl();
-        let projectSlug = projectId;
-        let orgSlug = null;
-        let projectMeta = { id: projectId, slug: null, name: null, orgId: null, orgSlug: null };
-        try {
-          const data = await api('GET', '/api/projects');
-          const proj = (data.projects || []).find(p => p.id === projectId);
-          if (proj) {
-            projectSlug = proj.slug || projectId;
-            orgSlug = proj.orgSlug || null;
-            projectMeta = { id: proj.id, slug: proj.slug || null, name: proj.name || null, orgId: proj.orgId || null, orgSlug };
-          }
-        } catch { /* fall back to projectId */ }
+        const projectMeta = resolved || { id: projectId, slug: null, name: null, orgId: null, orgSlug: null };
+        const projectSlug = projectMeta.slug || projectId;
+        const orgSlug = projectMeta.orgSlug || null;
         setMcpActiveProject(projectId, projectMeta);
         // Semantic /o/<org-slug>/<project-slug> when the org slug is known; otherwise
         // the /project/<slug> resolver redirects to it.
@@ -2564,6 +2656,7 @@ tool('get_org', {
 // ── Filesystem tools (direct HTTP to /api/fs) ─────────────────────
 
 tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by path, frame URL, or UUID), write (new frame or overwrite), set_state / get_state (persist or read a deployed windowType:"app" frame\'s hydration state — push e.g. {specText} to drive a generic app frame with data after deploy; the canvas hydrates the app from it on load), Google Sheet actions (`get_sheet`, `read_sheet_values`, `write_sheet_values`, `append_sheet_rows`, `clear_sheet_range`, `update_sheet`), Google Doc actions (`get_doc`, `read_doc_content`, `write_doc_content`, `append_doc_content`, `clear_doc_content`, `update_doc`), Google Slide actions (`get_slide`, `read_slide_content`, `write_slide_content`, `append_slides`, `clear_slides`, `update_slide`), write_excalidraw (native editable Excalidraw diagram), edit (hashline ops), mv (rename/move), anchor (mark as required-read for the layer), search (match frame names). Use project(action="open") first. For listing use `ls`, for deletion use `rm`.\n\n**Google Workspace native content:** Create or attach Google Docs/Sheets/Slides with `frame(action="write", googleType=...)`. After creating, immediately populate the native file using the matching write action in the same tool — do NOT leave it empty and do NOT tell the user you cannot write to it. For Sheets: `write_sheet_values` or `append_sheet_rows` (pass `path` or `googleId` from the create response). For Docs: `write_doc_content`/`append_doc_content`. For Slides: `write_slide_content`/`append_slides`. Read with `read_sheet_values`/`read_doc_content`/`read_slide_content`. Do NOT use inline `frame.write(content)` or hashline `frame.edit` to populate Google Workspace frames.\n\n**Write — content, binary, or Google Workspace frame:** ' + (isRemote ? 'Provide exactly one of `content` (HTML/markdown/text), `base64` (base64-encoded binary with optional `content_type`), or `googleType` (`google-doc`, `google-sheet`, `google-slide`).' : 'Provide exactly one of `content` (HTML/markdown/text), `file_path` (absolute local file), `base64` (base64-encoded binary with optional `content_type`), or `googleType` (`google-doc`, `google-sheet`, `google-slide`).') + ' Call get_org first; when `googleDrive.connected` is true, strongly prefer Google Workspace frames for docs, sheets, and slides in that org. For inline content, filename extension matters: use `.html` for complete HTML documents and `.md` for Markdown. Never place a full HTML document in a `.md` or extensionless frame. For a new Google file, pass `googleType` and optional `title`; for an existing Google file, pass `googleType` plus `url` or `googleId`. ' + (isRemote ? 'For binary frames (images, PDFs, videos), pass `base64` with the binary bytes.' : 'For binary frames (images, PDFs, videos), use `file_path` when the file is local to the MCP host, or `base64` when the caller already has binary bytes.') + '\n\n**Write — dimensions:** By default, frames use the layer\'s default size (e.g. 1440×900 for designs, 1440×3000 for wireframes). Often too large for small content. Use `autoSize: true` to measure HTML content and size to fit, or pass explicit `width`/`height`.', {
+  projectId: PROJECT_OVERRIDE_PARAM,
   action: z.enum(['read', 'write', 'set_state', 'get_state', 'write_sheet_values', 'read_sheet_values', 'append_sheet_rows', 'clear_sheet_range', 'get_sheet', 'update_sheet', 'get_doc', 'read_doc_content', 'write_doc_content', 'append_doc_content', 'clear_doc_content', 'update_doc', 'get_slide', 'read_slide_content', 'write_slide_content', 'append_slides', 'clear_slides', 'update_slide', 'create_office', 'read_office', 'edit_office', 'write_excalidraw', 'edit', 'mv', 'anchor', 'search', 'versions', 'read_version', 'restore_version']).describe('Operation to perform. Use native Doc/Slide actions for Google Docs/Slides; do not use inline write/edit for native Workspace content.'),
   path: z.string().optional().describe('[read] /{layer}/{lane}/{filename}, frame URL, or UUID. [write|edit|anchor] /{layer}/{lane}/{filename}.'),
   lines: z.string().optional().describe('[read] line range (e.g. "1-50"). Omit to read all.'),
@@ -2650,7 +2743,6 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
   dryRun: z.boolean().optional().describe('[mv] preview the move without applying it; returns the resolved frame and current path so you can confirm before retrying with dryRun=false.'),
   anchored: z.boolean().optional().describe('[anchor] true to anchor, false to unanchor. Anchored frames MUST be read before writing/editing in the same layer.'),
   query: z.string().optional().describe('[search] term to match against frame names'),
-  projectId: z.string().optional().describe('[search] limit to a specific project (optional)'),
   limit: z.number().optional().describe('[search] max results (default 50, max 200)'),
   versionId: z.string().optional().describe('[read_version|restore_version] version id'),
   reason: z.string().optional().describe('[restore_version] reason recorded on the snapshot of current content'),
@@ -3040,7 +3132,9 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         const { query, projectId, limit = 50 } = args;
         if (!query) throw new Error('query required for action=search');
         const params = new URLSearchParams({ q: query });
-        if (projectId) params.set('projectId', projectId);
+        // projectId may be a slug/name (the shared override param) — the tool() seam has
+        // already resolved it into state, so take the resolved UUID from there.
+        if (projectId) params.set('projectId', getState().projectId || projectId);
         await ensureSession();
         const url = `${getServerUrl()}/api/search?${params.toString()}`;
         const res = await fetch(url, { headers: getAuthHeaders() });
@@ -3069,6 +3163,7 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
 });
 
 tool('ls', 'List contents of the ACTIVE PROJECT. Use ls / after project(action="open") to see layers, workflow, and confirm you\'re in the right project.', {
+  projectId: PROJECT_OVERRIDE_PARAM,
   path: z.string().optional().default('/').describe('Directory path: / (layers), /{layer} (lanes), /{layer}/{lane} (frames). Frame entries include frameUrl (canvas deep link) and id (frame UUID).'),
   recursive: z.boolean().optional().describe('List contents of subdirectories. When true, forces summary mode (metadata only, no full content) to keep results under the 25k token cap.'),
   summary: z.boolean().optional().describe('Include size, updatedAt, title for frames'),
@@ -3140,10 +3235,17 @@ tool('ls', 'List contents of the ACTIVE PROJECT. Use ls / after project(action="
   } catch (error) { return err(error); }
 });
 
-tool('rm', 'Delete a frame or lane from the ACTIVE PROJECT. Response includes "project" field so you see where the deletion landed.', {
-  path: z.string().describe('Path to delete: /{layer}/{lane}/{filename} or /{layer}/{lane} (deletes entire lane).'),
-}, async ({ path }) => {
+tool('rm', 'Delete a frame or lane. Defaults to the ACTIVE PROJECT; pass projectId to delete in another project, or frameId to delete a frame by UUID from anywhere (no project binding needed — the frame\'s own org/project is authoritative). Response includes "project" so you see where the deletion landed.', {
+  projectId: PROJECT_OVERRIDE_PARAM,
+  path: z.string().optional().describe('Path to delete: /{layer}/{lane}/{filename} or /{layer}/{lane} (deletes entire lane). Mutually exclusive with frameId.'),
+  frameId: z.string().optional().describe('Frame UUID to delete, resolved independently of the active project — the one-call cleanup for a frame that landed in the wrong place. Mutually exclusive with path.'),
+}, async ({ path, frameId }) => {
   try {
+    if (frameId && path) throw new Error('Pass either path or frameId, not both.');
+    if (!frameId && !path) throw new Error('rm needs a path or a frameId.');
+    // A frame UUID self-derives its org and project server-side, so this works from an
+    // unbound session and across projects — no open/re-open dance to remove a stray frame.
+    if (frameId) return ok(await api('DELETE', `/api/designs/${encodeURIComponent(frameId)}`));
     const clean = path.replace(/^\/+|\/+$/g, '');
     const result = await api('DELETE', `/api/fs/${clean}`);
     return ok({ ...result, project: getCurrentProjectContext() });
@@ -3257,6 +3359,7 @@ tool('batch', 'Batch operations on the ACTIVE PROJECT. Response includes "projec
 // ── Asset tools ──────────────────────────────────────────────────
 
 tool('asset', 'Manage supporting files (CSS, JS, images, fonts) in the ACTIVE PROJECT. Assets are referenced by frames via relative paths — e.g., if your HTML has <link href="css/styles.css">, upload with asset_path="css/styles.css". Assets are NOT frames — they don\'t appear on the canvas. `action=upload` to add/replace, `action=list` to browse, `action=rm` to delete.', {
+  projectId: PROJECT_OVERRIDE_PARAM,
   action: z.enum(['upload', 'list', 'rm']).describe('Operation to perform.'),
   asset_path: z.string().optional().describe('[upload] relative asset path (e.g. "css/styles.css"). Must match the path used in HTML references.'),
   file_path: z.string().optional().describe('[upload] absolute path to a local file. Mutually exclusive with content/base64.'),
@@ -3311,6 +3414,7 @@ tool('asset', 'Manage supporting files (CSS, JS, images, fonts) in the ACTIVE PR
 // ── Connector tools ───────────────────────────────────────────────
 
 tool('connector', 'Create or remove connectors (arrows) between frames on the surface. `action=connect` adds an arrow from source to target. `action=disconnect` removes one — pass either connectorId directly or source+target to find and delete.', {
+  projectId: PROJECT_OVERRIDE_PARAM,
   action: z.enum(['connect', 'disconnect']).describe('Operation to perform.'),
   source: z.string().optional().describe('[connect|disconnect] source frame path or ID'),
   target: z.string().optional().describe('[connect|disconnect] target frame path or ID'),
@@ -3357,6 +3461,7 @@ tool('connector', 'Create or remove connectors (arrows) between frames on the su
 // ── Layout tools ──────────────────────────────────────────────────
 
 tool('layout', 'Auto-arrange frames using graph layout algorithm. Positions connected frames as a directed graph.', {
+  projectId: PROJECT_OVERRIDE_PARAM,
   direction: z.enum(['TB', 'LR', 'BT', 'RL']).optional().default('TB').describe('Layout direction: TB (top-bottom), LR (left-right), BT (bottom-top), RL (right-left)'),
 }, async ({ direction }) => {
   try {
@@ -3796,7 +3901,14 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
     // request, nothing is switched); otherwise the session's binding (the open
     // project's org). Resolving the override here keeps the echoed `org` field
     // and every emitted browser URL truthful about where the call landed.
-    let orgCtx = await getCurrentOrgContext();
+    // Where the write will ACTUALLY land: the working org (explicit switch, else the
+    // bound project's org — the same address api() puts on the wire). getCurrentOrgContext
+    // reports the session's INHERITED org, so echoing it made a correctly-placed write
+    // look misfiled — and an agent trusting that echo would "fix" a page that was fine.
+    const working = workingOrgId();
+    let orgCtx = working
+      ? ((await getOrgList()).find(o => o.id === working) || { id: working, name: null })
+      : await getCurrentOrgContext();
     if (args.org) {
       const d = await api('GET', '/api/orgs');
       const list = (d.orgs || d || []).map(o => ({ id: o.orgId || o.id, name: o.orgName || o.name }));

package/mcp/test-org-guards.mjs

@@ -5,14 +5,19 @@ import assert from 'node:assert/strict';
 import { projectlessMutationNeedsOrg } from './server.mjs';
 
 // One rule governs create AND fork (a fork is a create). A write proceeds when its
-// org is a real root — explicit org=, a bound/active project, a remote-adopted org,
-// or a single-org user's only org. It refuses to GUESS only when the user is
-// multi-org with nothing bound.
+// org is a real root — explicit org=, a bound/active project, or a single-org user's
+// only org. It refuses to GUESS only when the user is multi-org with nothing bound.
 assert.equal(projectlessMutationNeedsOrg({ explicitOrg: 'ee', orgCount: 5 }), false, 'explicit org → allow');
 assert.equal(projectlessMutationNeedsOrg({ boundOrgId: 'causeway', orgCount: 5 }), false, 'bound project → allow (a real root, not the cursor)');
 assert.equal(projectlessMutationNeedsOrg({ activeProjectId: 'p1', orgCount: 5 }), false, 'active project → allow');
-assert.equal(projectlessMutationNeedsOrg({ isRemote: true, orgCount: 5 }), false, 'remote session → allow (adopts its own connection org)');
 assert.equal(projectlessMutationNeedsOrg({ orgCount: 1 }), false, 'single org → allow');
+
+// A remote session is NOT a root. Its session org is the org the connection INHERITED
+// (the user's default), not one anybody chose — that inheritance wrote a Beoflow-bound
+// agent's wiki page into Personal. Multi-org remote must name its org like anyone else;
+// single-org remote stays frictionless (covered by the orgCount:1 case above).
+assert.equal(projectlessMutationNeedsOrg({ isRemote: true, orgCount: 5 }), true, 'remote + multi-org → BLOCK (its session org is inherited, not chosen)');
+assert.equal(projectlessMutationNeedsOrg({ isRemote: true, orgCount: 1 }), false, 'remote + single org → allow');
 assert.equal(projectlessMutationNeedsOrg({ orgCount: 0 }), false, 'unknown membership → allow (never block a legit write)');
 assert.equal(projectlessMutationNeedsOrg({ orgCount: 3 }), true, 'multi-org, nothing bound → BLOCK (refuse to guess)');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.14.10",
+  "version": "1.14.12",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [