drafted 1.14.11 → 1.14.13

package/mcp/server.mjs

@@ -180,8 +180,11 @@ function scrubLocalPathMentions(description) {
 // project is the one legitimately-kept addressing root, NOT the deleted session
 // cursor. Awareness of a surprising destination (e.g. a fork) comes from the
 // response receipt naming the org (orgEcho), not from hard-blocking the flow.
-export function projectlessMutationNeedsOrg({ explicitOrg, boundOrgId, activeProjectId, isRemote, orgCount }) {
-  if (explicitOrg || boundOrgId || activeProjectId || isRemote) return false;
+// A remote session is NOT an exemption: its session org is inherited (the user's default),
+// not chosen, so for a multi-org user it is exactly the guess this guard exists to refuse.
+// Single-org callers (remote or stdio) are unambiguous and proceed.
+export function projectlessMutationNeedsOrg({ explicitOrg, boundOrgId, activeProjectId, orgCount }) {
+  if (explicitOrg || boundOrgId || activeProjectId) return false;
   return (orgCount || 0) > 1;
 }
 
@@ -927,6 +930,17 @@ async function serverFetch(url, opts) {
   catch (e) { throw enrichFetchError(e, url); }
 }
 
+// The org this session is actually working in: an explicit switch, else the org of the
+// bound project (a project belongs to exactly one org, so it IS an address). Never the
+// server session's org — that one is INHERITED (a fresh session lands on the user's
+// default), and trusting it is what wrote a Beoflow-bound agent's wiki page into
+// Personal. Used both to address requests (X-Drafted-Org) and to echo where a write
+// landed, so the two can never disagree.
+function workingOrgId() {
+  const session = getSessionState();
+  return session.boundOrgId || session.activeProjectMeta?.orgId || getState().projectMeta?.orgId || null;
+}
+
 async function api(method, path, body, extraHeaders = {}, _retried = false) {
   await ensureSession();
   const pid = getState().projectId;
@@ -951,7 +965,26 @@ async function api(method, path, body, extraHeaders = {}, _retried = false) {
   // per-request — exactly like the org-less /project/:slug link that already
   // works. An explicit override in extraHeaders (e.g. the wiki/skill `org` arg)
   // always wins, and /auth/* is left untouched so it reports true session state.
-  const boundOrg = getSessionState().boundOrgId;
+  // The bound project's org is as good an address as an explicit switch — and it's the
+  // one the projectless-mutation guard already credits. Send it when boundOrgId wasn't
+  // set (an open whose meta lacked orgId, or state rehydrated from an older on-disk
+  // entry), so an org-scoped write can never fall back to the session's inherited org.
+  // A bound project whose org we don't know yet (an open whose meta lacked orgId, or an
+  // older on-disk entry rehydrated at boot) leaves workingOrgId() null — and then an
+  // org-scoped write would resolve against the session's inherited org. Learn the org
+  // from the project itself, once. The /api/projects guard stops resolveProjectRef, which
+  // calls that endpoint, from recursing back into here.
+  if (pid && !workingOrgId() && !path.startsWith('/api/projects')) {
+    try {
+      const meta = await resolveProjectRef(pid);
+      if (meta?.orgId) {
+        const s = getSessionState();
+        s.boundOrgId = meta.orgId;
+        s.activeProjectMeta = s.activeProjectMeta || meta;
+      }
+    } catch { /* best-effort; the server derives org from ?projectId anyway */ }
+  }
+  const boundOrg = workingOrgId();
   const hasExplicitOrg = Object.keys(headers).some((k) => k.toLowerCase() === 'x-drafted-org');
   if (boundOrg && !hasExplicitOrg && !path.startsWith('/auth/')) {
     headers['X-Drafted-Org'] = boundOrg;
@@ -1402,28 +1435,37 @@ async function requireBoundOrgForProjectlessMutation(explicitOrg) {
   if (explicitOrg) return;
   const sess = getSessionState();
   if (sess.boundOrgId) return;            // bound via project open (org = project's org)
-  if (getState().projectId) return;        // an active project implies its org
-  // Remote/web sessions are isolated per connection: each one gets its OWN
-  // server-side session row with its own org_id set on connect, so the session
-  // org IS this session's binding — there's no shared, long-lived session to
-  // confuse here the way stdio has. Adopt that org automatically instead of
-  // forcing the agent to open a project before a project-less
-  // wiki or skill write. The DRAFT-36 Phase 4 "refuse to guess" guard below
-  // therefore applies to stdio only.
-  if (isRemote) {
+  if (getState().projectId) return;        // an active project implies its org — api() now
+                                           // sends that project's org as X-Drafted-Org, so
+                                           // the org the guard credits is the org used
+  const orgs = await getOrgList();
+  if (!orgs.length) return; // can't determine membership — don't block a legit write
+  // A remote/web session does get its own server-side session row, but for a MULTI-ORG
+  // user the org on it is the one the connection INHERITED (the user's default), not one
+  // anybody chose — adopting it as a binding is how a Beoflow write landed in Personal.
+  // A single-org user is unambiguous, so keep the zero-friction path for them.
+  if (isRemote && orgs.length === 1) {
     const ctx = await getCurrentOrgContext();
     if (ctx?.id) sess.boundOrgId = ctx.id;
     return;
   }
-  const orgs = await getOrgList();
-  if (!orgs.length) return; // can't determine membership — don't block a legit write
   if (projectlessMutationNeedsOrg({ orgCount: orgs.length })) {
+    // Actionable, not a dead end: name the orgs and the ONE call that binds this session,
+    // so the agent recovers itself instead of stalling on the human. Project-less wiki and
+    // skill work is a first-class flow — no project required, ever. The only thing refused
+    // is GUESSING which org, which is what silently misfiled a page into the user's
+    // default org. (Listing the orgs is safe: they're the caller's own memberships.)
+    const names = orgs.map(o => o.name || o.id).filter(Boolean);
     throw new Error(
-      `Refusing to guess the org: no project is open and no explicit org was ` +
-      `given, but you belong to ${orgs.length} orgs — a project-less wiki/skill write ` +
-      `would land in whichever org the session inherited. Pass org=... on this ` +
-      `call (org name or id), or open the relevant project first ` +
-      `(project(action="open") — the org derives from the project).`
+      `Which org? A project-less wiki/skill write needs one, and you belong to ${orgs.length}: ` +
+      `${names.join(', ')}. Don't guess — an unaddressed write lands in whichever org this ` +
+      `session inherited, which is how a page meant for one org ends up in another.\n` +
+      `Recover in ONE call:\n` +
+      `  • get_org(action="use", org="<name>") — binds this session's working org; every ` +
+      `later project-less wiki/skill write then just works, no project needed.\n` +
+      `  • or pass org="<name>" on this single call.\n` +
+      `  • or project(action="open") if the work belongs to a project — the org derives from it.\n` +
+      `Pick from the conversation if the org is clear from context; ask the user only if it isn't.`
     );
   }
 }
@@ -3516,7 +3558,7 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
   path: z.string().optional().describe('[read_file|update_file] relative path inside skill directory (e.g. "examples/react.md")'),
   offset: z.number().optional().describe('[search|list|export] skip N results for pagination; [read_file] start reading at this byte offset (default 0) — for large files (e.g. a >90KB app-frame bundle) read in chunks using the returned nextOffset until truncated=false'),
   maxBytes: z.number().optional().describe('[read_file] return at most this many bytes from offset (default: whole remaining file). Response reports totalSize/offset/truncated/nextOffset.'),
-  org: z.string().optional().describe('[add] org (id or name) the skill is born in — defaults to the open project\'s org; [list|search|load] scope to this org; [fork|push|update|export|import] resolve/fork into this org. Per-request only — nothing is switched.'),
+  org: z.string().optional().describe('[add] org (id or name) the skill is born in — defaults to the open project\'s org; [list|search|load] scope to this org; [fork|push|update|export|import] resolve/fork into this org. Per-request only — nothing is switched. NO PROJECT IS NEEDED: for project-less skill work either pass org= here, or bind the session once with get_org(action="use", org="<name>"). A multi-org caller that addresses neither is refused rather than guessed.'),
   setup: z.array(z.string()).optional().describe('[add|update] setup command(s) (in order) run on materialize to build a source-only skill, e.g. ["npm ci","npm run build"]'),
   files: z.array(z.object({ path: z.string(), content: z.string() })).optional().describe('[push] source files to push (path + UTF-8 content); server strips artifacts + enforces caps. [import] OKF bundle files inline — skills/<slug>/SKILL.md dirs and Skill/Playbook/SOP/Procedure-typed .md with name + description frontmatter become org skills. Caps: 500 files, 512KB/file, 5MB total.'),
   dir: z.string().optional().describe('[push|export|import] local directory. push: source tree to push instead of files[]; walked locally (heavy dirs, .skillinstall/, and .skillignore pre-filtered), server re-enforces; the dir\'s .gitignore is auto-updated to exclude .skillinstall/ (the rebuildable bundle). export: write the OKF bundle files here (default ./okf-skills-<org>). import: read the bundle from here (alternative to files[]).'),
@@ -3814,7 +3856,7 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
   action: z.enum(['ls', 'recent', 'read', 'search', 'links', 'log', 'health', 'write', 'edit', 'mv', 'rm', 'cite', 'source-register', 'source-list', 'source-get', 'bulk-write', 'export', 'import']).describe('Operation to perform. export: the whole wiki as an OKF v0.1 bundle (local dir on stdio, download URL on remote, or format="files" for paged inline files). import: ingest an OKF bundle (files[] or local dir; dryRun supported).'),
   path: z.string().optional().describe('[ls|read|links|cite] wiki path. For ls: default / (root). For read: required. For links/cite: required unless pageId given. Reading `index.md` (any level) returns the SYNTHESIZED OKF directory listing.'),
   pageId: z.string().optional().describe('[read|edit|mv|rm|links] page UUID (from read/search). UUID-first: addresses the page directly, org auto-derives — no org needed and no path lookup. Preferred over path for an existing page.'),
-  org: z.string().optional().describe('Org slug or id to scope this call to (per-request only — nothing is switched). [write] the org the page is created in — required when you belong to several orgs and no project is open. [search] restrict to this org (default: ALL your orgs). [ls|recent|read|links|log|health|edit|mv|rm|bulk-write] target this org\'s wiki instead of the open project\'s org. Ignored when a pageId is given (the page self-derives its org).'),
+  org: z.string().optional().describe('Org slug or id to scope this call to (per-request only — nothing is switched). NO PROJECT IS NEEDED for wiki work: to write project-less, either pass org= here, or bind the session once with get_org(action="use", org="<name>") and then omit it. Multi-org callers MUST address the org one of those two ways — an unaddressed write is refused rather than guessed (it would land in whichever org the session inherited). [write] the org the page is created in. [search] restrict to this org (default: ALL your orgs). [ls|recent|read|links|log|health|edit|mv|rm|bulk-write] target this org\'s wiki instead of the open project\'s org. Ignored when a pageId is given (the page self-derives its org).'),
   recursive: z.boolean().optional().describe('[ls] list recursively with depth indicators'),
   limit: z.number().optional().describe('[recent|search|export] max results (recent default 10, search default 25, export files default 100)'),
   offset: z.number().optional().describe('[export] pagination offset for format="files"'),
@@ -3869,7 +3911,14 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
     // request, nothing is switched); otherwise the session's binding (the open
     // project's org). Resolving the override here keeps the echoed `org` field
     // and every emitted browser URL truthful about where the call landed.
-    let orgCtx = await getCurrentOrgContext();
+    // Where the write will ACTUALLY land: the working org (explicit switch, else the
+    // bound project's org — the same address api() puts on the wire). getCurrentOrgContext
+    // reports the session's INHERITED org, so echoing it made a correctly-placed write
+    // look misfiled — and an agent trusting that echo would "fix" a page that was fine.
+    const working = workingOrgId();
+    let orgCtx = working
+      ? ((await getOrgList()).find(o => o.id === working) || { id: working, name: null })
+      : await getCurrentOrgContext();
     if (args.org) {
       const d = await api('GET', '/api/orgs');
       const list = (d.orgs || d || []).map(o => ({ id: o.orgId || o.id, name: o.orgName || o.name }));

package/mcp/test-org-guards.mjs

@@ -5,14 +5,19 @@ import assert from 'node:assert/strict';
 import { projectlessMutationNeedsOrg } from './server.mjs';
 
 // One rule governs create AND fork (a fork is a create). A write proceeds when its
-// org is a real root — explicit org=, a bound/active project, a remote-adopted org,
-// or a single-org user's only org. It refuses to GUESS only when the user is
-// multi-org with nothing bound.
+// org is a real root — explicit org=, a bound/active project, or a single-org user's
+// only org. It refuses to GUESS only when the user is multi-org with nothing bound.
 assert.equal(projectlessMutationNeedsOrg({ explicitOrg: 'ee', orgCount: 5 }), false, 'explicit org → allow');
 assert.equal(projectlessMutationNeedsOrg({ boundOrgId: 'causeway', orgCount: 5 }), false, 'bound project → allow (a real root, not the cursor)');
 assert.equal(projectlessMutationNeedsOrg({ activeProjectId: 'p1', orgCount: 5 }), false, 'active project → allow');
-assert.equal(projectlessMutationNeedsOrg({ isRemote: true, orgCount: 5 }), false, 'remote session → allow (adopts its own connection org)');
 assert.equal(projectlessMutationNeedsOrg({ orgCount: 1 }), false, 'single org → allow');
+
+// A remote session is NOT a root. Its session org is the org the connection INHERITED
+// (the user's default), not one anybody chose — that inheritance wrote a Beoflow-bound
+// agent's wiki page into Personal. Multi-org remote must name its org like anyone else;
+// single-org remote stays frictionless (covered by the orgCount:1 case above).
+assert.equal(projectlessMutationNeedsOrg({ isRemote: true, orgCount: 5 }), true, 'remote + multi-org → BLOCK (its session org is inherited, not chosen)');
+assert.equal(projectlessMutationNeedsOrg({ isRemote: true, orgCount: 1 }), false, 'remote + single org → allow');
 assert.equal(projectlessMutationNeedsOrg({ orgCount: 0 }), false, 'unknown membership → allow (never block a legit write)');
 assert.equal(projectlessMutationNeedsOrg({ orgCount: 3 }), true, 'multi-org, nothing bound → BLOCK (refuse to guess)');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.14.11",
+  "version": "1.14.13",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [