drafted 1.14.27 → 1.14.29

package/mcp/active-project-store.mjs

@@ -7,10 +7,18 @@
  * Persisting it lets the long-lived stdio process rehydrate transparently after
  * a restart.
  *
- * Keyed by cwd so two concurrent same-machine agent sessions (each its own
- * stdio MCP, same launch config) don't clobber each other's active project.
- * Only the stdio process persists here; HTTP/remote user sessions are keyed by
- * a real Drafted session id and never call into this store.
+ * Keyed by SERVER URL + cwd so two concurrent same-machine agent sessions (each
+ * its own stdio MCP, same launch config) don't clobber each other's active
+ * project. The server is part of the key because project and org ids are only
+ * meaningful within one server's DATABASE: this repo registers both a prod
+ * (`https://drafted.live`) and a local-dev (`http://localhost:3477`) stdio MCP,
+ * and with a cwd-only key the local MCP's project+boundOrgId were rehydrated by
+ * the prod MCP at boot — which pinned the prod session's working org to an org
+ * id that exists only in the local dev DB (`get_org` reported a workingOrg with
+ * name:null that was in no membership, and every project-less call failed with
+ * `not a member of org "<local-uuid>"`). Cross-database state must never share a
+ * key. Only the stdio process persists here; HTTP/remote user sessions are keyed
+ * by a real Drafted session id and never call into this store.
  *
  * Side-effect-free on import (no network, no eager writes) so it can be unit
  * tested against the real code without booting the MCP server.
@@ -25,10 +33,18 @@ function defaultCwd() {
   try { return process.cwd(); } catch { return '__default__'; }
 }
 
-export function loadPersistedProject({ file = DEFAULT_FILE, cwd = defaultCwd() } = {}) {
+// serverUrl first: a URL never contains "|", so the composite key is unambiguous.
+function stateKey(cwd, serverUrl) {
+  return serverUrl ? `${serverUrl}|${cwd}` : cwd;
+}
+
+export function loadPersistedProject({ file = DEFAULT_FILE, cwd = defaultCwd(), serverUrl = '' } = {}) {
   try {
     const all = JSON.parse(readFileSync(file, 'utf8'));
-    const e = all && all[cwd];
+    // Pre-composite-key entries (bare cwd) are NOT read back: they carry no record of
+    // which server minted their ids, and adopting one is exactly the cross-DB bleed
+    // above. Worst case the agent re-opens its project once.
+    const e = all && all[stateKey(cwd, serverUrl)];
     if (e && e.activeProjectId) {
       return {
         activeProjectId: e.activeProjectId,
@@ -40,18 +56,20 @@ export function loadPersistedProject({ file = DEFAULT_FILE, cwd = defaultCwd() }
   return null;
 }
 
-export function savePersistedProject(entry, { file = DEFAULT_FILE, cwd = defaultCwd() } = {}) {
+export function savePersistedProject(entry, { file = DEFAULT_FILE, cwd = defaultCwd(), serverUrl = '' } = {}) {
   try {
     let all = {};
     try { all = JSON.parse(readFileSync(file, 'utf8')) || {}; } catch { /* recreate */ }
+    const key = stateKey(cwd, serverUrl);
+    if (key !== cwd) delete all[cwd]; // drop the un-namespaced legacy entry for this cwd
     if (entry && entry.activeProjectId) {
-      all[cwd] = {
+      all[key] = {
         activeProjectId: entry.activeProjectId,
         activeProjectMeta: entry.activeProjectMeta || null,
         boundOrgId: entry.boundOrgId || null,
       };
     } else {
-      delete all[cwd];
+      delete all[key];
     }
     mkdirSync(dirname(file), { recursive: true });
     writeFileSync(file, JSON.stringify(all), { mode: 0o600 });

package/mcp/server.mjs

@@ -189,6 +189,34 @@ export function projectlessMutationNeedsOrg({ explicitOrg, boundOrgId, activePro
   return (orgCount || 0) > 1;
 }
 
+// Did the server reject the working org THIS session injected as X-Drafted-Org?
+// A working org the caller isn't a member of can only be stale or foreign — state
+// rehydrated from another server's database, or the user removed from the org —
+// and because api() addresses EVERY request with it, it poisons every project-less
+// call ("not a member of org <uuid>") until the process restarts. Pure + exported so
+// the truth table is assertable in isolation (mcp/test-org-guards.mjs). An explicitly
+// passed org is the CALLER's address, never ours to drop — surface that error as-is.
+export function boundOrgRejected({ message, boundOrgId, hasExplicitOrg }) {
+  if (!boundOrgId || hasExplicitOrg) return false;
+  const msg = String(message || '');
+  return /not a member of org/i.test(msg) && msg.includes(boundOrgId);
+}
+
+// Which org should a mutation receipt name?
+//
+// A UUID-addressed resource (pageId=…) self-derives its org SERVER-side, so a
+// write can land in an org this session isn't bound to. Echoing the session's
+// working org in that case reproduces the bug the URL builder had: `org:` names
+// one org while `url:` points at another. Prefer the org carried on the returned
+// row; fall back to the session context only when the response doesn't name one.
+// Pure + exported so the truth table is assertable (mcp/test-org-guards.mjs).
+export function receiptOrg({ resourceOrgId, sessionOrg, orgList }) {
+  const rid = resourceOrgId || null;
+  if (!rid || rid === sessionOrg?.id) return sessionOrg;
+  const found = (orgList || []).find((o) => o.id === rid);
+  return found || { id: rid, name: null };
+}
+
 export function createMcpServer(transport) {
 // Remote transports (hosted HTTP MCP for claude.ai / ChatGPT) run on the
 // server, not the user's machine, so local-filesystem params like `file_path`
@@ -499,7 +527,10 @@ const PENDING_AUTH_FILE = process.env.DRAFTED_PENDING_AUTH_FILE || `${AUTH_FILE}
 // bucket (boundOrgId → the X-Drafted-Org per-request scope). No-op when the
 // file is absent (fresh install, or the hosted server process).
 (function rehydrateStdioActiveProject() {
-  const p = loadPersistedProject();
+  // serverUrl namespaces the entry: ids from a different server's database (the
+  // local dev MCP registered alongside the prod one in this repo) must never
+  // rehydrate here — that is what pinned boundOrgId to a non-existent org.
+  const p = loadPersistedProject({ serverUrl: getServerUrl() });
   if (!p) { getOrCreateSessionState(null); return; }
   standaloneState.projectId = p.activeProjectId;
   standaloneState.projectMeta = p.activeProjectMeta || null;
@@ -945,7 +976,7 @@ function workingOrgId() {
   return session.boundOrgId || session.activeProjectMeta?.orgId || getState().projectMeta?.orgId || null;
 }
 
-async function api(method, path, body, extraHeaders = {}, _retried = false) {
+async function api(method, path, body, extraHeaders = {}, _retried = false, _orgHealed = false) {
   await ensureSession();
   const pid = getState().projectId;
   const sep = path.includes('?') ? '&' : '?';
@@ -1010,7 +1041,7 @@ async function api(method, path, body, extraHeaders = {}, _retried = false) {
     getState().sessionId = null;
     const approved = await consumePendingDeviceCode();
     if (!approved) await cloneSession();
-    return api(method, path, body, extraHeaders, true);
+    return api(method, path, body, extraHeaders, true, _orgHealed);
   }
 
   let data;
@@ -1032,6 +1063,31 @@ async function api(method, path, body, extraHeaders = {}, _retried = false) {
         .join('\n');
       msg += `\n${detail}`;
     }
+    // The org we addressed this request to isn't one the caller belongs to. Drop it
+    // and retry ONCE unaddressed rather than let a bogus id stay the silent default:
+    // the project-less guards then ask for an explicit org instead of guessing.
+    if (!_orgHealed && boundOrgRejected({ message: msg, boundOrgId: boundOrg, hasExplicitOrg })) {
+      const sess = getSessionState();
+      sess.boundOrgId = null;
+      sess.cachedOrgs = null;
+      // activeProjectMeta.orgId is the next rung of workingOrgId(), so a project from
+      // the same foreign org would simply re-inject it on the retry.
+      if (sess.activeProjectMeta?.orgId === boundOrg) {
+        sess.activeProjectId = null;
+        sess.activeProjectMeta = null;
+        getState().projectId = null;
+        getState().projectMeta = null;
+      }
+      if (sess._stdio) {
+        savePersistedProject(
+          sess.activeProjectId
+            ? { activeProjectId: sess.activeProjectId, activeProjectMeta: sess.activeProjectMeta, boundOrgId: null }
+            : null,
+          { serverUrl: getServerUrl() }
+        );
+      }
+      return api(method, path, body, extraHeaders, _retried, true);
+    }
     // The active project no longer resolves in the current org context.
     // This is the silent-drift bug: project.open set a project, then
     // something switched the active org (parallel agent, browser tab, or
@@ -1048,7 +1104,7 @@ async function api(method, path, body, extraHeaders = {}, _retried = false) {
       const sess = getSessionState();
       sess.activeProjectId = null;
       sess.activeProjectMeta = null;
-      if (sess._stdio) savePersistedProject(null);
+      if (sess._stdio) savePersistedProject(null, { serverUrl: getServerUrl() });
       throw new Error(
         `${msg} — the active project (${meta?.slug || pid}) is no longer in the current org. ` +
         `Active project cleared. Call project(action="open") to set a new one, or proceed without one for org-scoped tools (wiki, skill).`
@@ -1243,7 +1299,10 @@ function setMcpActiveProject(projectId, meta = null) {
   if (meta?.orgId) sess.boundOrgId = meta.orgId;
   // Persist for the stdio process so an MCP restart rehydrates this project.
   if (sess._stdio) {
-    savePersistedProject(projectId ? { activeProjectId: projectId, activeProjectMeta: meta, boundOrgId: sess.boundOrgId } : null);
+    savePersistedProject(
+      projectId ? { activeProjectId: projectId, activeProjectMeta: meta, boundOrgId: sess.boundOrgId } : null,
+      { serverUrl: getServerUrl() }
+    );
   }
 }
 
@@ -2773,8 +2832,14 @@ tool('get_org', {
     // It's the per-session boundOrgId — set by an open project, a get_org(action="use"),
     // or (remote) the connection's org — not the shared session cursor. Announce it so an
     // agent can self-verify without guessing (invariant: "announced, never opaque").
-    const workingOrgId = getSessionState().boundOrgId || null;
-    const workingOrg = workingOrgId ? (orgs.find(o => o.id === workingOrgId) || { id: workingOrgId, name: null }) : null;
+    // Never REPORT a working org the caller isn't a member of. The old fallback
+    // fabricated `{ id, name: null }` for an unknown id, which is how a stale/foreign
+    // binding read as a real (if nameless) org instead of as the defect it is. If it
+    // isn't in the memberships we just fetched, it can't address anything — clear it
+    // so the session falls back to asking for an explicit org.
+    const sess = getSessionState();
+    const workingOrg = sess.boundOrgId ? (orgs.find(o => o.id === sess.boundOrgId) || null) : null;
+    if (sess.boundOrgId && !workingOrg) sess.boundOrgId = null;
 
     const googleDrive = await getGoogleDriveAvailability();
     const mcpUpdate = await getCachedMcpUpdateMetadata();
@@ -4077,8 +4142,11 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
     // reports the session's INHERITED org, so echoing it made a correctly-placed write
     // look misfiled — and an agent trusting that echo would "fix" a page that was fine.
     const working = workingOrgId();
+    // Cached for 30s, so this is a cache hit on all but the first wiki call in a
+    // session — cheap enough to always have on hand for the receipt below.
+    const orgList = await getOrgList();
     let orgCtx = working
-      ? ((await getOrgList()).find(o => o.id === working) || { id: working, name: null })
+      ? (orgList.find(o => o.id === working) || { id: working, name: null })
       : await getCurrentOrgContext();
     if (args.org) {
       const d = await api('GET', '/api/orgs');
@@ -4091,10 +4159,25 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
     const orgId = orgCtx?.id || null;
     // Mutation responses include `org` so the agent always sees where the
     // write landed — eliminates silent cross-org confusion.
-    const withOrg = (result) => ({ ...result, org: orgCtx });
+    //
+    // A UUID-addressed resource (pageId=…) SELF-DERIVES its org server-side, so
+    // for those the write can land in an org this session isn't bound to. Echoing
+    // the session's working org there is the same defect the URL builder had: the
+    // receipt would name one org while `url` pointed at another. Prefer the org
+    // carried on the returned row, and fall back to the session context only when
+    // the response doesn't name one.
+    const withOrg = (result, resourceOrgId) => ({
+      ...result,
+      org: receiptOrg({ resourceOrgId: resourceOrgId || result?.orgId, sessionOrg: orgCtx, orgList }),
+    });
     // Org-qualify every browser URL this tool emits (shadows the module fn for
     // all call sites below) so links are portable across the viewer's orgs.
-    const wikiBrowserUrl = (p) => wikiPageUrl(p, orgId);
+    // A UUID-addressed page SELF-DERIVES its org server-side, so its URL must be
+    // built from the org on the returned row (`resourceOrg`), not from this session's
+    // working org — otherwise `wiki(action="read", pageId=…)` hands back a link into
+    // whatever org the session happens to be bound to, for a page that lives elsewhere.
+    // Path-addressed calls have no resource org and correctly fall back to `orgId`.
+    const wikiBrowserUrl = (p, resourceOrg) => wikiPageUrl(p, resourceOrg || orgId);
 
     // ── Skill gate: all mutation actions ──────────────────────────
     // Ensure the wiki-maintainer skill is attached to this org BEFORE the
@@ -4217,7 +4300,7 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
           lastEditedBy: page.updatedBy,
           lastEditedAt: page.updatedAt,
           backlinkCount,
-          url: wikiBrowserUrl(page.path),
+          url: wikiBrowserUrl(page.path, page.orgId),
         });
       }
 
@@ -4331,7 +4414,7 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
             source = await api('POST', '/api/wiki/sources', { contentHash: citeHash, filename: citeFilename }, orgHeader);
           } catch { /* source registration is best-effort */ }
         }
-        return ok(withOrg({ cited: true, n, entry, path: page.path, id: page.id, sourceId: source?.id, url: wikiBrowserUrl(page.path) }));
+        return ok(withOrg({ cited: true, n, entry, path: page.path, id: page.id, sourceId: source?.id, url: wikiBrowserUrl(page.path, page.orgId) }));
       }
 
       // ── health ──────────────────────────────────────────────────
@@ -4429,10 +4512,10 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
         try {
           const existing = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`, undefined, orgHeader);
           const result = await api('PATCH', `/api/wiki/pages/${existing.id}`, body, orgHeader);
-          return ok(withOrg({ path: result.path, title: result.title, id: result.id, updated: true, url: wikiBrowserUrl(result.path), note: logNote }));
+          return ok(withOrg({ path: result.path, title: result.title, id: result.id, updated: true, url: wikiBrowserUrl(result.path, result.orgId), note: logNote }));
         } catch {
           const result = await api('POST', '/api/wiki/pages', body, orgHeader);
-          return ok(withOrg({ path: result.path, title: result.title, id: result.id, created: true, url: wikiBrowserUrl(result.path), note: logNote }));
+          return ok(withOrg({ path: result.path, title: result.title, id: result.id, created: true, url: wikiBrowserUrl(result.path, result.orgId), note: logNote }));
         }
       }
 
@@ -4450,7 +4533,7 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
           id = page.id;
         }
         const result = await api('POST', `/api/wiki/pages/${id}/edit`, { operations: editOps });
-        return ok(withOrg({ path: result.path, id: result.id, updated: true, applied: result.applied, url: wikiBrowserUrl(result.path) }));
+        return ok(withOrg({ path: result.path, id: result.id, updated: true, applied: result.applied, url: wikiBrowserUrl(result.path, result.orgId) }));
       }
 
       // ── mv ──────────────────────────────────────────────────────
@@ -4474,7 +4557,7 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
 
         // Server-side cascade: /move rewrites referrers in one transaction
         const moved = await api('PATCH', `/api/wiki/pages/${id}/move`, { path: toPath });
-        return ok(withOrg({ path: moved.path, title: moved.title, id: moved.id, referrersUpdated: moved.referrersUpdated ?? 0, url: wikiBrowserUrl(moved.path) }));
+        return ok(withOrg({ path: moved.path, title: moved.title, id: moved.id, referrersUpdated: moved.referrersUpdated ?? 0, url: wikiBrowserUrl(moved.path, moved.orgId) }));
       }
 
       // ── rm ──────────────────────────────────────────────────────

package/mcp/test-org-guards.mjs

@@ -2,7 +2,11 @@
 // Run: `node mcp/test-org-guards.mjs`. No framework — asserts the single pure
 // decision core that the org guard delegates to, for BOTH creates and forks.
 import assert from 'node:assert/strict';
-import { projectlessMutationNeedsOrg } from './server.mjs';
+import { mkdtempSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { projectlessMutationNeedsOrg, boundOrgRejected, receiptOrg } from './server.mjs';
+import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';
 
 // One rule governs create AND fork (a fork is a create). A write proceeds when its
 // org is a real root — explicit org=, a bound/active project, or a single-org user's
@@ -32,6 +36,115 @@ assert.equal(projectlessMutationNeedsOrg(incident), false, 'incident state: fork
 // The genuinely ambiguous case still errors for a fork, exactly as for a create:
 assert.equal(projectlessMutationNeedsOrg({ orgCount: 3 }), true, 'multi-org fork with nothing bound → BLOCK before any copy is created');
 
+// ── Persisted stdio state must not cross DATABASES ────────────────────────────
+// The 2026-07-31 incident: this repo registers a prod stdio MCP (drafted.live) and a
+// local-dev one (localhost:3477) that run in the SAME cwd. Keyed by cwd alone, the
+// local MCP's activeProject + boundOrgId were rehydrated by the prod MCP at boot, so
+// the prod session addressed every request to an org id that exists only in the local
+// dev DB: get_org reported `workingOrg {id: <local-uuid>, name: null}` in no membership
+// list, and project-less calls failed `not a member of org "<local-uuid>"`.
+const file = join(mkdtempSync(join(tmpdir(), 'drafted-state-')), 'mcp-state.json');
+const cwd = '/Users/x/GitHub/drafted.live';
+const PROD = 'https://drafted.live';
+const LOCAL = 'http://localhost:3477';
+
+savePersistedProject(
+  { activeProjectId: 'local-project', boundOrgId: 'b111302a-local-db-only' },
+  { file, cwd, serverUrl: LOCAL }
+);
+assert.equal(
+  loadPersistedProject({ file, cwd, serverUrl: PROD }),
+  null,
+  'prod MCP must NOT rehydrate the local dev MCP state saved in the same cwd'
+);
+assert.equal(
+  loadPersistedProject({ file, cwd, serverUrl: LOCAL })?.boundOrgId,
+  'b111302a-local-db-only',
+  'same server + same cwd still rehydrates (the feature this persistence exists for)'
+);
+
+savePersistedProject({ activeProjectId: 'prod-project', boundOrgId: 'org-prod' }, { file, cwd, serverUrl: PROD });
+assert.equal(loadPersistedProject({ file, cwd, serverUrl: PROD })?.activeProjectId, 'prod-project');
+assert.equal(
+  loadPersistedProject({ file, cwd, serverUrl: LOCAL })?.activeProjectId,
+  'local-project',
+  'the two servers keep independent entries for one cwd'
+);
+
+// A pre-fix (bare-cwd) entry carries no record of which server minted its ids, so it is
+// never adopted — that entry IS the poisoned state.
+savePersistedProject({ activeProjectId: 'legacy', boundOrgId: 'b111302a-local-db-only' }, { file, cwd });
+assert.equal(loadPersistedProject({ file, cwd, serverUrl: PROD })?.activeProjectId, 'prod-project',
+  'a legacy un-namespaced entry never leaks into a server-scoped read');
+
+// ── A non-member working org can never stay the silent default ────────────────
+const stale = 'b111302a-937c-489b-8cec-a422c853ce85';
+assert.equal(
+  boundOrgRejected({ message: `not a member of org "${stale}"`, boundOrgId: stale }),
+  true,
+  'server rejected the org WE addressed the request to → drop it and retry unaddressed'
+);
+assert.equal(
+  boundOrgRejected({ message: `not a member of org "${stale}"`, boundOrgId: stale, hasExplicitOrg: true }),
+  false,
+  'an explicit org= is the CALLER\'s address — surface the error, never silently drop it'
+);
+assert.equal(
+  boundOrgRejected({ message: 'not a member of org "Drafted"', boundOrgId: stale }),
+  false,
+  'a rejection naming a DIFFERENT org is not ours to heal'
+);
+assert.equal(boundOrgRejected({ message: 'Project not found', boundOrgId: stale }), false, 'unrelated error → no heal');
+assert.equal(boundOrgRejected({ message: `not a member of org "${stale}"` }), false, 'nothing bound → nothing to drop');
+
+// ── receiptOrg: the mutation receipt must name where the write LANDED ─────────
+// Regression for the sibling of the foreign-org bug: a UUID-addressed page
+// self-derives its org server-side, so echoing the session's working org made
+// `org:` disagree with the (correct) `url:` on a cross-org edit.
+{
+  const ORGS = [
+    { id: 'org-a', name: 'Alpha' },
+    { id: 'org-b', name: 'Bravo' },
+  ];
+  const SESSION = { id: 'org-a', name: 'Alpha' };
+
+  // resource lives in the session's own org → session context, unchanged
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-a', sessionOrg: SESSION, orgList: ORGS }),
+    SESSION,
+    'same-org write should echo the session org',
+  );
+
+  // response carries no org (path-addressed) → fall back to session context
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: null, sessionOrg: SESSION, orgList: ORGS }),
+    SESSION,
+    'no resource org should fall back to the session org',
+  );
+
+  // THE BUG: resource lives elsewhere → must name the resource's org, not the session's
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-b', sessionOrg: SESSION, orgList: ORGS }),
+    { id: 'org-b', name: 'Bravo' },
+    'cross-org write must echo the org the write landed in',
+  );
+
+  // resource org not in the membership list → still name it, honestly, rather
+  // than silently substituting the session org
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-z', sessionOrg: SESSION, orgList: ORGS }),
+    { id: 'org-z', name: null },
+    'unknown resource org should be named with a null name, not swapped out',
+  );
+
+  // no session org at all (unbound) and a resource org present
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-b', sessionOrg: null, orgList: ORGS }),
+    { id: 'org-b', name: 'Bravo' },
+    'unbound session should still name the resource org',
+  );
+}
+
 console.log('org-guard policy OK');
 // Importing server.mjs builds the stdio MCP singleton, which opens a WS reconnect
 // loop that keeps the event loop alive. Assertions are done — exit deterministically.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.14.27",
+  "version": "1.14.29",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [
@@ -36,7 +36,8 @@
     "deploy:check:google": "node scripts/check-google-drive-deploy.mjs",
     "build:excalidraw": "node scripts/build-excalidraw-editor.mjs",
     "build:office-viewer": "node scripts/build-office-viewer.mjs",
-    "prepublishOnly": "node scripts/check-npm-package.mjs"
+    "prepublishOnly": "node scripts/check-npm-package.mjs",
+    "test:marketing": "node server/lib/marketing/test-marketing.mjs"
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1007.0",