drafted 1.14.11 → 1.14.12

package/mcp/server.mjs

@@ -180,8 +180,11 @@ function scrubLocalPathMentions(description) {
 // project is the one legitimately-kept addressing root, NOT the deleted session
 // cursor. Awareness of a surprising destination (e.g. a fork) comes from the
 // response receipt naming the org (orgEcho), not from hard-blocking the flow.
-export function projectlessMutationNeedsOrg({ explicitOrg, boundOrgId, activeProjectId, isRemote, orgCount }) {
-  if (explicitOrg || boundOrgId || activeProjectId || isRemote) return false;
+// A remote session is NOT an exemption: its session org is inherited (the user's default),
+// not chosen, so for a multi-org user it is exactly the guess this guard exists to refuse.
+// Single-org callers (remote or stdio) are unambiguous and proceed.
+export function projectlessMutationNeedsOrg({ explicitOrg, boundOrgId, activeProjectId, orgCount }) {
+  if (explicitOrg || boundOrgId || activeProjectId) return false;
   return (orgCount || 0) > 1;
 }
 
@@ -927,6 +930,17 @@ async function serverFetch(url, opts) {
   catch (e) { throw enrichFetchError(e, url); }
 }
 
+// The org this session is actually working in: an explicit switch, else the org of the
+// bound project (a project belongs to exactly one org, so it IS an address). Never the
+// server session's org — that one is INHERITED (a fresh session lands on the user's
+// default), and trusting it is what wrote a Beoflow-bound agent's wiki page into
+// Personal. Used both to address requests (X-Drafted-Org) and to echo where a write
+// landed, so the two can never disagree.
+function workingOrgId() {
+  const session = getSessionState();
+  return session.boundOrgId || session.activeProjectMeta?.orgId || getState().projectMeta?.orgId || null;
+}
+
 async function api(method, path, body, extraHeaders = {}, _retried = false) {
   await ensureSession();
   const pid = getState().projectId;
@@ -951,7 +965,26 @@ async function api(method, path, body, extraHeaders = {}, _retried = false) {
   // per-request — exactly like the org-less /project/:slug link that already
   // works. An explicit override in extraHeaders (e.g. the wiki/skill `org` arg)
   // always wins, and /auth/* is left untouched so it reports true session state.
-  const boundOrg = getSessionState().boundOrgId;
+  // The bound project's org is as good an address as an explicit switch — and it's the
+  // one the projectless-mutation guard already credits. Send it when boundOrgId wasn't
+  // set (an open whose meta lacked orgId, or state rehydrated from an older on-disk
+  // entry), so an org-scoped write can never fall back to the session's inherited org.
+  // A bound project whose org we don't know yet (an open whose meta lacked orgId, or an
+  // older on-disk entry rehydrated at boot) leaves workingOrgId() null — and then an
+  // org-scoped write would resolve against the session's inherited org. Learn the org
+  // from the project itself, once. The /api/projects guard stops resolveProjectRef, which
+  // calls that endpoint, from recursing back into here.
+  if (pid && !workingOrgId() && !path.startsWith('/api/projects')) {
+    try {
+      const meta = await resolveProjectRef(pid);
+      if (meta?.orgId) {
+        const s = getSessionState();
+        s.boundOrgId = meta.orgId;
+        s.activeProjectMeta = s.activeProjectMeta || meta;
+      }
+    } catch { /* best-effort; the server derives org from ?projectId anyway */ }
+  }
+  const boundOrg = workingOrgId();
   const hasExplicitOrg = Object.keys(headers).some((k) => k.toLowerCase() === 'x-drafted-org');
   if (boundOrg && !hasExplicitOrg && !path.startsWith('/auth/')) {
     headers['X-Drafted-Org'] = boundOrg;
@@ -1402,21 +1435,20 @@ async function requireBoundOrgForProjectlessMutation(explicitOrg) {
   if (explicitOrg) return;
   const sess = getSessionState();
   if (sess.boundOrgId) return;            // bound via project open (org = project's org)
-  if (getState().projectId) return;        // an active project implies its org
-  // Remote/web sessions are isolated per connection: each one gets its OWN
-  // server-side session row with its own org_id set on connect, so the session
-  // org IS this session's binding — there's no shared, long-lived session to
-  // confuse here the way stdio has. Adopt that org automatically instead of
-  // forcing the agent to open a project before a project-less
-  // wiki or skill write. The DRAFT-36 Phase 4 "refuse to guess" guard below
-  // therefore applies to stdio only.
-  if (isRemote) {
+  if (getState().projectId) return;        // an active project implies its org — api() now
+                                           // sends that project's org as X-Drafted-Org, so
+                                           // the org the guard credits is the org used
+  const orgs = await getOrgList();
+  if (!orgs.length) return; // can't determine membership — don't block a legit write
+  // A remote/web session does get its own server-side session row, but for a MULTI-ORG
+  // user the org on it is the one the connection INHERITED (the user's default), not one
+  // anybody chose — adopting it as a binding is how a Beoflow write landed in Personal.
+  // A single-org user is unambiguous, so keep the zero-friction path for them.
+  if (isRemote && orgs.length === 1) {
     const ctx = await getCurrentOrgContext();
     if (ctx?.id) sess.boundOrgId = ctx.id;
     return;
   }
-  const orgs = await getOrgList();
-  if (!orgs.length) return; // can't determine membership — don't block a legit write
   if (projectlessMutationNeedsOrg({ orgCount: orgs.length })) {
     throw new Error(
       `Refusing to guess the org: no project is open and no explicit org was ` +
@@ -3869,7 +3901,14 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
     // request, nothing is switched); otherwise the session's binding (the open
     // project's org). Resolving the override here keeps the echoed `org` field
     // and every emitted browser URL truthful about where the call landed.
-    let orgCtx = await getCurrentOrgContext();
+    // Where the write will ACTUALLY land: the working org (explicit switch, else the
+    // bound project's org — the same address api() puts on the wire). getCurrentOrgContext
+    // reports the session's INHERITED org, so echoing it made a correctly-placed write
+    // look misfiled — and an agent trusting that echo would "fix" a page that was fine.
+    const working = workingOrgId();
+    let orgCtx = working
+      ? ((await getOrgList()).find(o => o.id === working) || { id: working, name: null })
+      : await getCurrentOrgContext();
     if (args.org) {
       const d = await api('GET', '/api/orgs');
       const list = (d.orgs || d || []).map(o => ({ id: o.orgId || o.id, name: o.orgName || o.name }));

package/mcp/test-org-guards.mjs

@@ -5,14 +5,19 @@ import assert from 'node:assert/strict';
 import { projectlessMutationNeedsOrg } from './server.mjs';
 
 // One rule governs create AND fork (a fork is a create). A write proceeds when its
-// org is a real root — explicit org=, a bound/active project, a remote-adopted org,
-// or a single-org user's only org. It refuses to GUESS only when the user is
-// multi-org with nothing bound.
+// org is a real root — explicit org=, a bound/active project, or a single-org user's
+// only org. It refuses to GUESS only when the user is multi-org with nothing bound.
 assert.equal(projectlessMutationNeedsOrg({ explicitOrg: 'ee', orgCount: 5 }), false, 'explicit org → allow');
 assert.equal(projectlessMutationNeedsOrg({ boundOrgId: 'causeway', orgCount: 5 }), false, 'bound project → allow (a real root, not the cursor)');
 assert.equal(projectlessMutationNeedsOrg({ activeProjectId: 'p1', orgCount: 5 }), false, 'active project → allow');
-assert.equal(projectlessMutationNeedsOrg({ isRemote: true, orgCount: 5 }), false, 'remote session → allow (adopts its own connection org)');
 assert.equal(projectlessMutationNeedsOrg({ orgCount: 1 }), false, 'single org → allow');
+
+// A remote session is NOT a root. Its session org is the org the connection INHERITED
+// (the user's default), not one anybody chose — that inheritance wrote a Beoflow-bound
+// agent's wiki page into Personal. Multi-org remote must name its org like anyone else;
+// single-org remote stays frictionless (covered by the orgCount:1 case above).
+assert.equal(projectlessMutationNeedsOrg({ isRemote: true, orgCount: 5 }), true, 'remote + multi-org → BLOCK (its session org is inherited, not chosen)');
+assert.equal(projectlessMutationNeedsOrg({ isRemote: true, orgCount: 1 }), false, 'remote + single org → allow');
 assert.equal(projectlessMutationNeedsOrg({ orgCount: 0 }), false, 'unknown membership → allow (never block a legit write)');
 assert.equal(projectlessMutationNeedsOrg({ orgCount: 3 }), true, 'multi-org, nothing bound → BLOCK (refuse to guess)');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.14.11",
+  "version": "1.14.12",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [