drafted 1.14.7 → 1.14.9

package/cli/drafted.mjs

@@ -1591,9 +1591,12 @@ async function syncOneSkill(ref, outDir, org) {
     mkdirSync(dirname(full), { recursive: true });
     writeFileSync(full, content);
   }
-  // createdBy lets the caller decide whether to auto-run this skill's setup: shell authored
-  // by someone else must not run unattended on sync (RCE via a teammate's/forked skill).
-  return { ref, slug, hash, status: 'ok', createdBy: skill.createdBy ?? null };
+  // createdBy + forkedFrom decide whether this skill's setup may auto-run: shell authored by
+  // someone else must not run unattended on sync. forkedFrom is load-bearing — the CLI/MCP
+  // AUTO-forks a global/other-org skill on use, which copies the source author's setup but
+  // stamps createdBy = the forking (victim) user, so createdBy alone would mislabel foreign
+  // setup as self-authored. A forked skill is never treated as self-authored.
+  return { ref, slug, hash, status: 'ok', createdBy: skill.createdBy ?? null, forkedFrom: skill.forkedFrom ?? null };
 }
 
 const skillCmd = program.command('skill').description('Skill library operations');
@@ -1626,7 +1629,10 @@ skillCmd
           // authored by another org member, a fork, or an imported bundle must NOT run their
           // shell unattended (Causeway auto-syncs pinned skills), or a teammate's skill is
           // RCE on this host. `--allow-untrusted-setup` is the explicit opt-in.
-          const selfAuthored = r.createdBy && auth?.userId && r.createdBy === auth.userId;
+          // Self-authored = created by me AND not a fork (a fork carries another author's
+          // setup under my createdBy — see syncOneSkill). Forks/other-authored require the
+          // explicit opt-in.
+          const selfAuthored = r.createdBy && auth?.userId && r.createdBy === auth.userId && !r.forkedFrom;
           if (selfAuthored || opts.allowUntrustedSetup) {
             const s = runSkillSetup(join(opts.out, r.slug));
             r.setup = s.skipped ? 'none' : (s.ok ? 'ok' : 'failed');

package/mcp/server.mjs

@@ -267,9 +267,7 @@ const TOOL_ANNOTATIONS = {
   // Assets
   asset:               { title: 'Assets',              readOnlyHint: false, destructiveHint: false, openWorldHint: false, description: 'Manage project assets (CSS/JS/images/fonts referenced by frames). `action=upload` or `action=list`.' },
 
-  // Shapes / connectors / groups / layout
-  shape:               { title: 'Add shape',           readOnlyHint: false, destructiveHint: false, openWorldHint: false },
-  group:               { title: 'Create group',        readOnlyHint: false, destructiveHint: false, openWorldHint: false },
+  // Connectors / layout
   connector:           { title: 'Connectors',          readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Connect or disconnect frames with arrows on the surface. `action=connect` or `action=disconnect`.' },
   layout:              { title: 'Auto-layout',         readOnlyHint: false, destructiveHint: false, openWorldHint: false },
 
@@ -307,8 +305,6 @@ function isMutatingToolCall(name, args = {}) {
     case 'minion':
       return ['create', 'update', 'enable', 'disable', 'delete', 'test_start', 'test_say', 'test_resolve'].includes(action);
     case 'rm':
-    case 'shape':
-    case 'group':
     case 'connector':
     case 'layout':
       return true;
@@ -1824,7 +1820,7 @@ tool('health', {}, async () => {
 
 // ── Project management tools (direct HTTP) ────────────────────────
 
-tool('project', 'START HERE for project management. Dispatch by `action`: list (lists all projects across all orgs — always call first), open (bind this agent session to a project; required before reading/writing frames — the org derives from the project), create (new project; org= names where it is born), update (change name/folder/description/layers), move (transfer to another org), export (the project as an OKF v0.1 bundle — <layer>/<lane>/<file>.md concepts, index.md/log.md synthesized), import (ingest an OKF bundle: concepts become markdown document frames, links between them become connectors; dryRun supported). There is no org switching: for project-less work (wiki/skills) pass org=... on the call. **Skill gate:** projects with attached skills will REJECT all mutations (write, edit, mv, rm, shape, group, connector, layout, layer, asset upload) until you have loaded each attached skill via skill(action="load"). Skills tell you HOW to do the work — they\'re not optional. Open returns the attached skill list and auto-inlines content for projects with ≤3 skills.', {
+tool('project', 'START HERE for project management. Dispatch by `action`: list (lists all projects across all orgs — always call first), open (bind this agent session to a project; required before reading/writing frames — the org derives from the project), create (new project; org= names where it is born), update (change name/folder/description/layers), move (transfer to another org), export (the project as an OKF v0.1 bundle — <layer>/<lane>/<file>.md concepts, index.md/log.md synthesized), import (ingest an OKF bundle: concepts become markdown document frames, links between them become connectors; dryRun supported). There is no org switching: for project-less work (wiki/skills) pass org=... on the call. **Skill gate:** projects with attached skills will REJECT all mutations (write, edit, mv, rm, connector, layout, layer, asset upload) until you have loaded each attached skill via skill(action="load"). Skills tell you HOW to do the work — they\'re not optional. Open returns the attached skill list and auto-inlines content for projects with ≤3 skills.', {
   action: z.enum(['list', 'open', 'create', 'update', 'move', 'export', 'import']).describe('Operation to perform.'),
   projectId: z.string().optional().describe('[open|update|move|export|import] project ID. Get IDs from action=list. For export/import: defaults to the bound project.'),
   name: z.string().optional().describe('[create|update] project name'),
@@ -2157,7 +2153,7 @@ tool('focus', {
   } catch (error) { return err(error); }
 });
 
-tool('screenshot', 'Render a PNG via headless browser. `scope=frame` captures a single frame (default 1440×900, fullPage). `scope=canvas` captures a region of the project surface (default 1600×1200, typically the "plans" layer where shapes live).', {
+tool('screenshot', 'Render a PNG via headless browser. `scope=frame` captures a single frame (default 1440×900, fullPage). `scope=canvas` captures a region of the project surface (default 1600×1200, typically the "plans" layer where frames live).', {
   scope: z.enum(['frame', 'canvas']).describe('What to capture.'),
   target: z.string().optional().describe('[scope=frame] frame URL, UUID, or /{layer}/{lane}/{filename} path.'),
   slug: z.string().optional().describe('[scope=canvas] project slug. Defaults to the currently active project.'),
@@ -3293,56 +3289,6 @@ tool('asset', 'Manage supporting files (CSS, JS, images, fonts) in the ACTIVE PR
   } catch (error) { return err(error); }
 });
 
-// ── Shape tool ───────────────────────────────────────────────────────
-
-tool('shape', 'Create a flowchart shape on the surface. Shapes are lightweight text nodes — use them for flowcharts, process diagrams, and decision trees. Connect shapes with connector(action="connect"), then call layout to auto-arrange.', {
-  text: z.string().describe('Text to display inside the shape. Supports multi-line with \\n.'),
-  shape: z.enum(['rectangle', 'diamond', 'oval', 'pill']).optional().default('rectangle').describe('Shape type: rectangle (process/action), diamond (decision), oval (start/end), pill (rounded step)'),
-  layer: z.string().optional().describe('Layer to place the shape in (default: plans)'),
-  lane: z.string().optional().describe('Lane within the layer (default: default)'),
-  color: z.string().optional().describe('Border color (CSS color string)'),
-  fill: z.string().optional().describe('Background fill color (CSS color string)'),
-  textColor: z.string().optional().describe('Text color (CSS color string)'),
-  group: z.string().optional().describe('Group ID to assign this shape to (for swim lane clustering). Use the ID returned by the group tool.'),
-  width: z.number().optional().describe('Explicit width in pixels (overrides auto-sizing from text)'),
-  height: z.number().optional().describe('Explicit height in pixels (overrides auto-sizing from text)'),
-  layoutIgnore: z.boolean().optional().describe('Exclude this shape from auto-layout. Use for annotations, labels, or manually positioned elements.'),
-}, async ({ text, shape, layer, lane, color, fill, textColor, group, width, height, layoutIgnore }) => {
-  try {
-    const body = { text, shape };
-    if (layer) body.layer = layer;
-    if (lane) body.lane = lane;
-    if (color) body.color = color;
-    if (fill) body.fill = fill;
-    if (textColor) body.textColor = textColor;
-    if (group) body.group = group;
-    if (width) body.width = width;
-    if (height) body.height = height;
-    if (layoutIgnore) body.layoutIgnore = true;
-    const result = await api('POST', '/api/fs/shape', body);
-    return ok(result);
-  } catch (error) { return err(error); }
-});
-
-tool('group', 'Create a group (swim lane / region) on the surface. Groups are labeled, colored background areas that visually contain shapes. Assign shapes to a group using the group parameter on the shape tool. Use layout with groups=true to auto-cluster.', {
-  label: z.string().describe('Group label text (displayed in the header bar)'),
-  color: z.string().optional().describe('Header bar and border color (CSS color string)'),
-  fill: z.string().optional().describe('Background fill color (CSS color string). Defaults to a tinted version of color.'),
-  layer: z.string().optional().describe('Layer to place the group in (default: plans)'),
-  lane: z.string().optional().describe('Lane within the layer (default: default)'),
-  order: z.number().optional().describe('Sort order for group positioning (lower = first). Default: 0'),
-}, async ({ label, color, fill, layer, lane, order }) => {
-  try {
-    const body = { label };
-    if (color) body.color = color;
-    if (fill) body.fill = fill;
-    if (layer) body.layer = layer;
-    if (lane) body.lane = lane;
-    if (order != null) body.order = order;
-    const result = await api('POST', '/api/fs/group', body);
-    return ok(result);
-  } catch (error) { return err(error); }
-});
 // ── Connector tools ───────────────────────────────────────────────
 
 tool('connector', 'Create or remove connectors (arrows) between frames on the surface. `action=connect` adds an arrow from source to target. `action=disconnect` removes one — pass either connectorId directly or source+target to find and delete.', {
@@ -3393,11 +3339,9 @@ tool('connector', 'Create or remove connectors (arrows) between frames on the su
 
 tool('layout', 'Auto-arrange frames using graph layout algorithm. Positions connected frames as a directed graph.', {
   direction: z.enum(['TB', 'LR', 'BT', 'RL']).optional().default('TB').describe('Layout direction: TB (top-bottom), LR (left-right), BT (bottom-top), RL (right-left)'),
-  groups: z.boolean().optional().default(false).describe('Enable group clustering. When true, shapes assigned to a group (via the group param) are clustered together, and group frames are resized to enclose their members.'),
-}, async ({ direction, groups }) => {
+}, async ({ direction }) => {
   try {
     const body = { direction };
-    if (groups) body.groups = true;
     const result = await api('POST', '/api/layout', body);
     return ok(result);
   } catch (error) { return err(error); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.14.7",
+  "version": "1.14.9",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [