drafted 1.14.28 → 1.14.30

package/mcp/server.mjs

@@ -202,6 +202,21 @@ export function boundOrgRejected({ message, boundOrgId, hasExplicitOrg }) {
   return /not a member of org/i.test(msg) && msg.includes(boundOrgId);
 }
 
+// Which org should a mutation receipt name?
+//
+// A UUID-addressed resource (pageId=…) self-derives its org SERVER-side, so a
+// write can land in an org this session isn't bound to. Echoing the session's
+// working org in that case reproduces the bug the URL builder had: `org:` names
+// one org while `url:` points at another. Prefer the org carried on the returned
+// row; fall back to the session context only when the response doesn't name one.
+// Pure + exported so the truth table is assertable (mcp/test-org-guards.mjs).
+export function receiptOrg({ resourceOrgId, sessionOrg, orgList }) {
+  const rid = resourceOrgId || null;
+  if (!rid || rid === sessionOrg?.id) return sessionOrg;
+  const found = (orgList || []).find((o) => o.id === rid);
+  return found || { id: rid, name: null };
+}
+
 export function createMcpServer(transport) {
 // Remote transports (hosted HTTP MCP for claude.ai / ChatGPT) run on the
 // server, not the user's machine, so local-filesystem params like `file_path`
@@ -230,7 +245,9 @@ BREADCRUMBS: When a frame you write or read corresponds to a file in the user's
 CONTEXT RULES (follow these before every action):
   - WIKI CHECK: Before acting on any request, search the org wiki for relevant conventions, existing designs, and prior decisions. Use wiki(action="search") with relevant keywords.
   - LAYER CONTEXT: Before reading or mutating a frame, read all anchored frames in the same layer. Anchored frames are per-layer required reading (style guides, design systems, conventions). The server enforces this mechanically for writes/edits/deletes/moves — but proactively reading anchored frames before any frame operation prevents wasted work.
-IMPORTANT: Any URL containing /f/{uuid} is a Drafted frame link — ALWAYS use read(path=URL) to get frame content, focus(target=URL) to pan the canvas to it. Never curl or WebFetch Drafted URLs.`,
+IMPORTANT: Any URL containing /f/{uuid} is a Drafted frame link — ALWAYS use read(path=URL) to get frame content, focus(target=URL) to pan the canvas to it. Never curl or WebFetch Drafted URLs.
+
+LINKING: link the user to the narrowest thing you touched, never the project as a stand-in. Wrote or edited ONE frame → give its \`frameUrl\` (from the write/read/ls response). Touched a whole lane → its \`laneUrl\`; a whole layer → its \`layerUrl\` (both on the matching \`ls\` entries). Only when the work spans the project is the project URL the right link. A project link where a frame link was available makes the user hunt the surface for what you just did.`,
 }, {
   // Initialize instructions: the agent-identity contract, so an agent learns its own
   // tab name + the right way to read it WITHOUT having to "think to" call a tool.
@@ -1245,6 +1262,10 @@ function withFrameBreadcrumb(result, { hint = false } = {}) {
   const out = { ...result, breadcrumb: `drafted:${result.id}` };
   if (hint) {
     out.breadcrumbHint = `If this frame maps to a file in the user's codebase, paste "drafted:${result.id}" as a comment in that file so future agents discover the link.`;
+    // The write path is where the project URL keeps getting substituted for the frame
+    // the agent just wrote. Name the right link at the moment it's produced.
+    const link = out.frameUrl || `${getServerUrl()}/f/${result.id}`;
+    out.linkHint = `Link the user to THIS frame — ${link} — not to the project URL.`;
   }
   return out;
 }
@@ -3383,7 +3404,7 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
 
 tool('ls', 'List contents of the ACTIVE PROJECT. Use ls / after project(action="open") to see layers, workflow, and confirm you\'re in the right project.', {
   projectId: PROJECT_OVERRIDE_PARAM,
-  path: z.string().optional().default('/').describe('Directory path: / (layers), /{layer} (lanes), /{layer}/{lane} (frames). Frame entries include frameUrl (canvas deep link) and id (frame UUID).'),
+  path: z.string().optional().default('/').describe('Directory path: / (layers), /{layer} (lanes), /{layer}/{lane} (frames). Frame entries include frameUrl (canvas deep link) and id (frame UUID); layer entries include layerUrl and lane entries laneUrl — relay those to the user instead of the project URL when your work was scoped to one layer or lane.'),
   recursive: z.boolean().optional().describe('List contents of subdirectories. When true, forces summary mode (metadata only, no full content) to keep results under the 25k token cap.'),
   summary: z.boolean().optional().describe('Include size, updatedAt, title for frames'),
   pattern: z.string().optional().describe('Glob pattern to filter filenames (e.g. "*.html")'),
@@ -4127,8 +4148,11 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
     // reports the session's INHERITED org, so echoing it made a correctly-placed write
     // look misfiled — and an agent trusting that echo would "fix" a page that was fine.
     const working = workingOrgId();
+    // Cached for 30s, so this is a cache hit on all but the first wiki call in a
+    // session — cheap enough to always have on hand for the receipt below.
+    const orgList = await getOrgList();
     let orgCtx = working
-      ? ((await getOrgList()).find(o => o.id === working) || { id: working, name: null })
+      ? (orgList.find(o => o.id === working) || { id: working, name: null })
       : await getCurrentOrgContext();
     if (args.org) {
       const d = await api('GET', '/api/orgs');
@@ -4141,7 +4165,17 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
     const orgId = orgCtx?.id || null;
     // Mutation responses include `org` so the agent always sees where the
     // write landed — eliminates silent cross-org confusion.
-    const withOrg = (result) => ({ ...result, org: orgCtx });
+    //
+    // A UUID-addressed resource (pageId=…) SELF-DERIVES its org server-side, so
+    // for those the write can land in an org this session isn't bound to. Echoing
+    // the session's working org there is the same defect the URL builder had: the
+    // receipt would name one org while `url` pointed at another. Prefer the org
+    // carried on the returned row, and fall back to the session context only when
+    // the response doesn't name one.
+    const withOrg = (result, resourceOrgId) => ({
+      ...result,
+      org: receiptOrg({ resourceOrgId: resourceOrgId || result?.orgId, sessionOrg: orgCtx, orgList }),
+    });
     // Org-qualify every browser URL this tool emits (shadows the module fn for
     // all call sites below) so links are portable across the viewer's orgs.
     // A UUID-addressed page SELF-DERIVES its org server-side, so its URL must be

package/mcp/test-org-guards.mjs

@@ -5,7 +5,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
-import { projectlessMutationNeedsOrg, boundOrgRejected } from './server.mjs';
+import { projectlessMutationNeedsOrg, boundOrgRejected, receiptOrg } from './server.mjs';
 import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';
 
 // One rule governs create AND fork (a fork is a create). A write proceeds when its
@@ -97,6 +97,54 @@ assert.equal(
 assert.equal(boundOrgRejected({ message: 'Project not found', boundOrgId: stale }), false, 'unrelated error → no heal');
 assert.equal(boundOrgRejected({ message: `not a member of org "${stale}"` }), false, 'nothing bound → nothing to drop');
 
+// ── receiptOrg: the mutation receipt must name where the write LANDED ─────────
+// Regression for the sibling of the foreign-org bug: a UUID-addressed page
+// self-derives its org server-side, so echoing the session's working org made
+// `org:` disagree with the (correct) `url:` on a cross-org edit.
+{
+  const ORGS = [
+    { id: 'org-a', name: 'Alpha' },
+    { id: 'org-b', name: 'Bravo' },
+  ];
+  const SESSION = { id: 'org-a', name: 'Alpha' };
+
+  // resource lives in the session's own org → session context, unchanged
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-a', sessionOrg: SESSION, orgList: ORGS }),
+    SESSION,
+    'same-org write should echo the session org',
+  );
+
+  // response carries no org (path-addressed) → fall back to session context
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: null, sessionOrg: SESSION, orgList: ORGS }),
+    SESSION,
+    'no resource org should fall back to the session org',
+  );
+
+  // THE BUG: resource lives elsewhere → must name the resource's org, not the session's
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-b', sessionOrg: SESSION, orgList: ORGS }),
+    { id: 'org-b', name: 'Bravo' },
+    'cross-org write must echo the org the write landed in',
+  );
+
+  // resource org not in the membership list → still name it, honestly, rather
+  // than silently substituting the session org
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-z', sessionOrg: SESSION, orgList: ORGS }),
+    { id: 'org-z', name: null },
+    'unknown resource org should be named with a null name, not swapped out',
+  );
+
+  // no session org at all (unbound) and a resource org present
+  assert.deepEqual(
+    receiptOrg({ resourceOrgId: 'org-b', sessionOrg: null, orgList: ORGS }),
+    { id: 'org-b', name: 'Bravo' },
+    'unbound session should still name the resource org',
+  );
+}
+
 console.log('org-guard policy OK');
 // Importing server.mjs builds the stdio MCP singleton, which opens a WS reconnect
 // loop that keeps the event loop alive. Assertions are done — exit deterministically.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.14.28",
+  "version": "1.14.30",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [