drafted 1.14.28 → 1.14.29

package/mcp/server.mjs

@@ -202,6 +202,21 @@ export function boundOrgRejected({ message, boundOrgId, hasExplicitOrg }) {
   return /not a member of org/i.test(msg) && msg.includes(boundOrgId);
 }
 
+// Which org should a mutation receipt name?
+//
+// A UUID-addressed resource (pageId=…) self-derives its org SERVER-side, so a
+// write can land in an org this session isn't bound to. Echoing the session's
+// working org in that case reproduces the bug the URL builder had: `org:` names
+// one org while `url:` points at another. Prefer the org carried on the returned
+// row; fall back to the session context only when the response doesn't name one.
+// Pure + exported so the truth table is assertable (mcp/test-org-guards.mjs).
+export function receiptOrg({ resourceOrgId, sessionOrg, orgList }) {
+  const rid = resourceOrgId || null;
+  if (!rid || rid === sessionOrg?.id) return sessionOrg;
+  const found = (orgList || []).find((o) => o.id === rid);
+  return found || { id: rid, name: null };
+}
+
 export function createMcpServer(transport) {
 // Remote transports (hosted HTTP MCP for claude.ai / ChatGPT) run on the
 // server, not the user's machine, so local-filesystem params like `file_path`
@@ -4127,8 +4142,11 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
     // reports the session's INHERITED org, so echoing it made a correctly-placed write
     // look misfiled — and an agent trusting that echo would "fix" a page that was fine.
     const working = workingOrgId();
+    // Cached for 30s, so this is a cache hit on all but the first wiki call in a
+    // session — cheap enough to always have on hand for the receipt below.
+    const orgList = await getOrgList();
     let orgCtx = working
-      ? ((await getOrgList()).find(o => o.id === working) || { id: working, name: null })
+      ? (orgList.find(o => o.id === working) || { id: working, name: null })
       : await getCurrentOrgContext();
     if (args.org) {
       const d = await api('GET', '/api/orgs');
@@ -4141,7 +4159,17 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
     const orgId = orgCtx?.id || null;
     // Mutation responses include `org` so the agent always sees where the
     // write landed — eliminates silent cross-org confusion.
-    const withOrg = (result) => ({ ...result, org: orgCtx });
+    //
+    // A UUID-addressed resource (pageId=…) SELF-DERIVES its org server-side, so
+    // for those the write can land in an org this session isn't bound to. Echoing
+    // the session's working org there is the same defect the URL builder had: the
+    // receipt would name one org while `url` pointed at another. Prefer the org
+    // carried on the returned row, and fall back to the session context only when
+    // the response doesn't name one.
+    const withOrg = (result, resourceOrgId) => ({
+      ...result,
+      org: receiptOrg({ resourceOrgId: resourceOrgId || result?.orgId, sessionOrg: orgCtx, orgList }),
+    });
     // Org-qualify every browser URL this tool emits (shadows the module fn for
     // all call sites below) so links are portable across the viewer's orgs.
     // A UUID-addressed page SELF-DERIVES its org server-side, so its URL must be

package/mcp/test-org-guards.mjs

@@ -5,7 +5,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
-import { projectlessMutationNeedsOrg, boundOrgRejected } from './server.mjs';
+import { projectlessMutationNeedsOrg, boundOrgRejected, receiptOrg } from './server.mjs';
 import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';
 
 // One rule governs create AND fork (a fork is a create). A write proceeds when its
@@ -97,6 +97,54 @@ assert.equal(
 assert.equal(boundOrgRejected({ message: 'Project not found', boundOrgId: stale }), false, 'unrelated error → no heal');
 assert.equal(boundOrgRejected({ message: `not a member of org "${stale}"` }), false, 'nothing bound → nothing to drop');
 
+// ── receiptOrg: the mutation receipt must name where the write LANDED ─────────
+// Regression for the sibling of the foreign-org bug: a UUID-addressed page
+// self-derives its org server-side, so echoing the session's working org made
+// `org:` disagree with the (correct) `url:` on a cross-org edit.
+{
+  const ORGS = [
+    { id: 'org-a', name: 'Alpha' },
+    { id: 'org-b', name: 'Bravo' },
+  ];
+  const SESSION = { id: 'org-a', name: 'Alpha' };
+
+  // resource lives in the session's own org → session context, unchanged
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-a', sessionOrg: SESSION, orgList: ORGS }),
+    SESSION,
+    'same-org write should echo the session org',
+  );
+
+  // response carries no org (path-addressed) → fall back to session context
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: null, sessionOrg: SESSION, orgList: ORGS }),
+    SESSION,
+    'no resource org should fall back to the session org',
+  );
+
+  // THE BUG: resource lives elsewhere → must name the resource's org, not the session's
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-b', sessionOrg: SESSION, orgList: ORGS }),
+    { id: 'org-b', name: 'Bravo' },
+    'cross-org write must echo the org the write landed in',
+  );
+
+  // resource org not in the membership list → still name it, honestly, rather
+  // than silently substituting the session org
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-z', sessionOrg: SESSION, orgList: ORGS }),
+    { id: 'org-z', name: null },
+    'unknown resource org should be named with a null name, not swapped out',
+  );
+
+  // no session org at all (unbound) and a resource org present
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-b', sessionOrg: null, orgList: ORGS }),
+    { id: 'org-b', name: 'Bravo' },
+    'unbound session should still name the resource org',
+  );
+}
+
 console.log('org-guard policy OK');
 // Importing server.mjs builds the stdio MCP singleton, which opens a WS reconnect
 // loop that keeps the event loop alive. Assertions are done — exit deterministically.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.14.28",
+  "version": "1.14.29",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [