drafted 1.19.20 → 1.19.23

package/mcp/repo-address.mjs

@@ -0,0 +1,215 @@
+/**
+ * What Drafted address does this working directory name?
+ *
+ * The MCP runs as a stdio process spawned in the user's repo. Until now it had
+ * no idea whether that repo was linked to a Drafted folder, so an agent working
+ * in a linked checkout would write to whatever org the session happened to
+ * inherit. The comment above `workingOrgId()` in server.mjs records where that
+ * ends: "trusting it is what wrote a Beoflow-bound agent's wiki page into
+ * Personal."
+ *
+ * Two rules shape this module:
+ *
+ * 1. It answers a PATH (/o/<org>/<folder>), never an orgId to stash. A stored
+ *    org becomes an inherited default, which is the bug we are fixing, not a
+ *    fix for it.
+ * 2. It does NOT normalize git URLs. Remotes go to the server raw and
+ *    parseGitHubUrl (server/lib/repo-ingest.mjs) stays the single normalizer.
+ *    A second normalizer that drifts from the first would reintroduce the
+ *    split-master problem inside the fix itself.
+ *
+ * Side-effect free and network-free: probe() shells out to git, resolve() is
+ * pure. That split is what makes this testable without a repo or a server.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+/** Run a git command in `cwd`, or null if git fails for any reason. Never
+ *  throws: not-a-repo, no git binary, and a detached HEAD are all ordinary. */
+function git(args, cwd) {
+  try {
+    const out = execFileSync('git', args, {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 2000,
+    });
+    return out.trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read the git identity of a working directory.
+ *
+ * `--show-toplevel` is what makes a monorepo subdirectory and a worktree behave:
+ * any cwd inside the tree normalizes to the repo root, and a worktree reports
+ * its own root while sharing the remote.
+ *
+ * Every remote is returned, origin first. A fork whose `origin` Drafted has
+ * never seen may still have an `upstream` that is linked, and resolving that is
+ * strictly better than reporting nothing.
+ */
+export function probeRepo(cwd = process.cwd()) {
+  const root = git(['rev-parse', '--show-toplevel'], cwd);
+  if (!root) return null;
+  const branch = git(['rev-parse', '--abbrev-ref', 'HEAD'], cwd);
+  const remotes = parseRemotes(git(['remote', '-v'], cwd));
+  return {
+    root,
+    // A detached HEAD reports the literal "HEAD"; that is not a branch name and
+    // must not be matched against repos.branch.
+    branch: branch && branch !== 'HEAD' ? branch : null,
+    remotes,
+    declared: readDeclaration(root),
+  };
+}
+
+/** `git remote -v` → [{ name, url }], deduped, origin first then upstream. */
+export function parseRemotes(text) {
+  const seen = new Map();
+  for (const line of String(text || '').split('\n')) {
+    const m = line.match(/^(\S+)\s+(\S+)\s+\(fetch\)$/);
+    if (m && !seen.has(m[1])) seen.set(m[1], m[2]);
+  }
+  const rank = (n) => (n === 'origin' ? 0 : n === 'upstream' ? 1 : 2);
+  return [...seen.entries()]
+    .map(([name, url]) => ({ name, url }))
+    .sort((a, b) => rank(a.name) - rank(b.name) || a.name.localeCompare(b.name));
+}
+
+/**
+ * The optional committed declaration, `<repo root>/.drafted/config.json`.
+ *
+ * This file SELECTS among candidates the server returned; it never grants
+ * access to anything. That distinction is the whole reason it is safe to
+ * commit: "which org is this repo?" is a per-USER question (membership differs
+ * per collaborator) and a committed file is a per-REPO answer. As a filter it
+ * is correct; as an authority it would be a way for a forked repo to point your
+ * session at someone else's org.
+ *
+ * Malformed or missing is not an error — it is the normal case.
+ */
+export function readDeclaration(root) {
+  try {
+    const raw = readFileSync(join(root, '.drafted', 'config.json'), 'utf8');
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object') return null;
+    const pick = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);
+    const declared = { org: pick(parsed.org), folder: pick(parsed.folder), gitUrl: pick(parsed.gitUrl) };
+    return declared.org || declared.folder ? declared : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Turn the server's candidate list into one address, or an honest non-answer.
+ *
+ * States, and why each exists:
+ *   none      — not a git repo. Behaves exactly as today.
+ *   unlinked  — a remote exists and matched nothing. An EXPLICIT negative: a
+ *               bare "not linked" is indistinguishable from "I failed to parse
+ *               your remote", and that ambiguity is this feature's most likely
+ *               silent failure, so the probed URLs are always echoed.
+ *   linked    — exactly one candidate, or the declaration picked one.
+ *   ambiguous — several member orgs link this repo. Adopt NOTHING. This is the
+ *               case where a wrong write is both most plausible and least
+ *               detectable, so it is never guessed.
+ */
+export function resolveAddress(probe, matches = []) {
+  if (!probe) return { state: 'none' };
+  const base = {
+    root: probe.root,
+    branch: probe.branch,
+    remote: probe.remotes[0]?.url ?? null,
+  };
+  if (!matches.length) {
+    return { ...base, state: 'unlinked', probed: probe.remotes.map((r) => r.url) };
+  }
+
+  const picked = matches.length === 1 ? matches[0] : selectByDeclaration(probe.declared, matches);
+  if (!picked) {
+    return { ...base, state: 'ambiguous', candidates: matches.map((m) => m.path) };
+  }
+
+  // The branch is reported, never enforced: reading a folder whose index tracks
+  // another branch is legitimate, it just has to be visible.
+  const onTrackedBranch = !probe.branch || picked.branch === probe.branch;
+  return {
+    ...base,
+    state: 'linked',
+    path: picked.path,
+    org: picked.orgName,
+    orgId: picked.orgId,
+    orgSlug: picked.orgSlug,
+    folder: picked.folderName,
+    trackedBranch: picked.branch,
+    onTrackedBranch,
+    viaDeclaration: matches.length > 1,
+  };
+}
+
+/** Match a declaration against candidates by org name/slug and folder name.
+ *  Returns null unless it selects exactly one — an ambiguous declaration is no
+ *  better than no declaration, and must not break the tie by accident. */
+function selectByDeclaration(declared, matches) {
+  if (!declared) return null;
+  const eq = (a, b) => typeof a === 'string' && typeof b === 'string' && a.toLowerCase() === b.toLowerCase();
+  const hits = matches.filter(
+    (m) =>
+      (!declared.org || eq(declared.org, m.orgName) || eq(declared.org, m.orgSlug)) &&
+      (!declared.folder || eq(declared.folder, m.folderName))
+  );
+  return hits.length === 1 ? hits[0] : null;
+}
+
+/** The prose an agent reads. Written to TEACH, like the 409 repo_owned gate:
+ *  it names the address to use and the fact that other orgs stay reachable. */
+export function addressNote(address, workingOrgId) {
+  if (!address || address.state === 'none') return null;
+  if (address.state === 'unknown') {
+    // Say WHICH question went unanswered. "Not linked" and "could not ask" look
+    // identical to an agent, and only one of them means it is safe to proceed.
+    return `This is a git checkout (${address.remote || 'no remote'}) but Drafted could not be asked whether it is linked (${address.reason}). Nothing is defaulted — address writes explicitly, and re-check with whoami once signed in.`;
+  }
+  if (address.state === 'unlinked') {
+    return `This checkout (${address.probed.join(', ') || 'no remote'}) is not linked to any Drafted folder you can see. Nothing is defaulted — address writes explicitly.`;
+  }
+  if (address.state === 'ambiguous') {
+    return `This checkout is linked in more than one org you belong to (${address.candidates.join(', ')}). Nothing is defaulted — pass org= or an absolute /o/<org>/... path.`;
+  }
+  const parts = [`Your working directory is the repo linked to ${address.path}.`];
+  if (workingOrgId && workingOrgId !== address.orgId) {
+    parts.push(`This session's working org is a DIFFERENT org — address work under ${address.path}/... unless the user asked for another org.`);
+  }
+  if (!address.onTrackedBranch) {
+    parts.push(`Note: that folder tracks branch ${address.trackedBranch} and you are on ${address.branch}, so its index describes another branch.`);
+  }
+  parts.push(`That folder's wiki and skills are git-owned: writes return 409 repo_owned and belong in a commit. Other orgs stay reachable with org= or /o/<org>/... .`);
+  return parts.join(' ');
+}
+
+// Self-check: parsing and resolution, no git and no network.
+export function demo() {
+  const ok = (c, m) => { if (!c) throw new Error(m); };
+  const remotes = parseRemotes('upstream\tgit@github.com:a/b.git (fetch)\nupstream\tx (push)\norigin\thttps://github.com/c/d (fetch)');
+  ok(remotes[0].name === 'origin', 'origin ranks first');
+  ok(remotes.length === 2, 'deduped to two remotes');
+
+  ok(resolveAddress(null).state === 'none', 'no repo -> none');
+  const probe = { root: '/r', branch: 'main', remotes: [{ name: 'origin', url: 'u' }], declared: null };
+  ok(resolveAddress(probe, []).state === 'unlinked', 'no matches -> unlinked');
+
+  const one = { path: '/o/x/F', orgName: 'X', orgSlug: 'x', orgId: 'o1', folderName: 'F', branch: 'main' };
+  ok(resolveAddress(probe, [one]).state === 'linked', 'single match -> linked');
+
+  const two = { ...one, path: '/o/y/G', orgName: 'Y', orgSlug: 'y', orgId: 'o2', folderName: 'G' };
+  ok(resolveAddress(probe, [one, two]).state === 'ambiguous', 'two matches -> ambiguous');
+  ok(resolveAddress({ ...probe, declared: { org: 'Y' } }, [one, two]).path === '/o/y/G', 'declaration breaks the tie');
+  ok(resolveAddress({ ...probe, declared: { org: 'Z' } }, [one, two]).state === 'ambiguous', 'declaration naming a non-candidate grants nothing');
+  console.log('repo-address self-check OK');
+}

package/mcp/server.mjs

@@ -24,6 +24,7 @@ import { emptyExcalidrawScene, stringifyExcalidrawScene } from '../src/shared/ex
 import { formatOkfLogEntry, appendOkfLogEntry } from '../src/shared/okf-log.mjs';
 import { createGateState, markSearched, g1Block, g2Block, g3Block, selectWithinBudget, wouldExceedBudget, budgetError, formatWikiIndex, formatProjectIndex, projectPath, PROJECT_CONTEXT_BUDGET_CHARS } from './gates.mjs';
 import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';
+import { probeRepo, resolveAddress, addressNote } from './repo-address.mjs';
 
 // Frame actions that mutate content — gated by G1 (wiki search before editing).
 // Read-style actions (read, search, versions, get_*/read_*) are exempt.
@@ -398,7 +399,7 @@ const TOOL_ANNOTATIONS = {
   auth:                { title: 'Sign in',             readOnlyHint: false, destructiveHint: false, openWorldHint: true,  description: 'Sign in to Drafted. `action=get_link` returns a URL immediately and starts background approval polling; after the user opens the link, later Drafted tool calls also auto-consume the approved login. `action=login` opens a browser when needed and explicitly waits/polls for approval.' },
 
   // Identity — read-only introspection of THIS agent's session
-  whoami:              { title: 'Session identity',    readOnlyHint: true,  destructiveHint: false, openWorldHint: false, description: 'Return THIS agent session\'s identity: its server-assigned human-readable name (the correlation key between an agent window and its web-app session tab), sessionId, userId, orgId, active projectId, editor label, server URL, and surfaced/alive state (`authState` says whether this session is signed in, and `authNote` names the exact call that fixes it when it is not — never diagnose a null userId yourself) — PLUS server health, the installed MCP version/update status (cached ~5min), and `googleDrive` — whether the working org has Google Drive connected: when `googleDrive.connected` is true, strongly prefer Google Workspace frames (.google-doc/.google-sheet/.google-slide) for docs, sheets, and decks; when false they cannot be created at all. Call once per session, right after starting, so a required update surfaces before you act on stale tool behavior. Read-only. Use this — not guesses from the host environment — to report which session you are.' },
+  whoami:              { title: 'Session identity',    readOnlyHint: true,  destructiveHint: false, openWorldHint: false, description: 'Return THIS agent session\'s identity: its server-assigned human-readable name (the correlation key between an agent window and its web-app session tab), sessionId, userId, orgId, active projectId, editor label, server URL, and surfaced/alive state (`authState` says whether this session is signed in, and `authNote` names the exact call that fixes it when it is not — never diagnose a null userId yourself) — PLUS server health, the installed MCP version/update status (cached ~5min), and `googleDrive` — whether the working org has Google Drive connected: when `googleDrive.connected` is true, strongly prefer Google Workspace frames (.google-doc/.google-sheet/.google-slide) for docs, sheets, and decks; when false they cannot be created at all. PLUS `repo` — whether your WORKING DIRECTORY is a git checkout linked to a Drafted folder, and if so its address (`/o/<org>/<folder>`): when `repo.state` is "linked", address work under `repo.path` unless the user asked otherwise, and read `repo.note`. `workingOrg` reports the org that actually ADDRESSES your requests and where it came from (`switch`/`project`/`repo`/`none`) — this is NOT always the same as `orgId`, which is the server session\'s org. Call once per session, right after starting, so a required update surfaces before you act on stale tool behavior. Read-only. Use this — not guesses from the host environment — to report which session you are.' },
 
   // Session naming — the name-before-work gate: every agent session must set a short
   // name describing the work before any other tool call succeeds.
@@ -417,7 +418,7 @@ const TOOL_ANNOTATIONS = {
   minion:              { title: 'Minions',             readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Manage Minions: checklist-driven intake surfaces that guide a consumer through a checklist (via a shareable /c/<slug> link) and write a producible into the project. Dispatch by `action`: meta, list, get, create, update, enable, disable, delete. QA your own Minions with test_start/test_say/test_resolve — drive the checklist conversation yourself (works even when disabled). Requires the agent allowlist.' },
   trigger:             { title: 'Inbound triggers',    readOnlyHint: false, destructiveHint: true,  openWorldHint: true,  description: 'Manage inbound webhook triggers for the ACTIVE PROJECT: an external system (AppSheet bot, GitHub, form tool) POSTs to the trigger URL and the server runs an agent conversation in the project from the stored prompt template + payload. Dispatch by `action`: create (returns URL + secret token ONCE — relay it to the user immediately, not retrievable later), list, update (enable/disable, edit template, daily limit, executor), rotate (new token), test (fire a synthetic delivery), deliveries (audit log), delete; for executor="queue" triggers, pending/claim/complete let a LOCAL agent poll and work queued deliveries. Requires the agent allowlist.' },
   fs:                  { title: 'Filesystem',           readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Navigate Drafted like a local filesystem: /wiki/<path> pages, /skills/<slug> procedures, /projects/<folder?>/<project>/<layer>/<lane>/<file> frames. Verbs: ls, read, write, edit, mv, rm, search, link, unlink, links.' },
-  repo:                { title: 'Git repos',           readOnlyHint: false, destructiveHint: true,  openWorldHint: true,  description: 'Registered git repos — the org index of .agents/ skills + identities. A connected repo is the source of truth for its skills; EVERY repo connected to ANY folder in the org is searchable and usable org-wide (no org-level repo — the union is the library). Skills from connected repos are readable via fs(read, path="/skills/<slug>") — fetched from git at read time, always fresh. Authoring a Drafted skill whose slug collides with a repo-indexed skill returns 409 repo_owned pointing at the repo. Dispatch by `action`: list (paginated, compact mode), add (link a repo to a folder, --branch optional), rescan (re-fetch the tracked branch), entries (search the index). Content stays in git; Drafted keeps a read-only index.' },
+  repo:                { title: 'Git repos',           readOnlyHint: false, destructiveHint: true,  openWorldHint: true,  description: 'Registered git repos — the org index of .agents/ skills + identities. A connected repo is the source of truth for its skills; EVERY repo connected to ANY folder in the org is searchable and usable org-wide (no org-level repo — the union is the library). Skills from connected repos are readable via fs(read, path="/skills/<slug>") — fetched from git at read time, always fresh. Authoring a Drafted skill whose slug collides with a repo-indexed skill returns 409 repo_owned pointing at the repo. Dispatch by `action`: list (paginated, compact mode), rescan (re-fetch the tracked branch), entries (search the index). Linking and unlinking are NOT here — a human does them in the Drafted UI. Content stays in git; Drafted keeps a read-only index.' },
 };
 
 function isMutatingToolCall(name, args = {}) {
@@ -434,6 +435,36 @@ function isMutatingToolCall(name, args = {}) {
   }
 }
 
+// Refuse to guess the destination, ONCE, when a write would land outside the
+// org this checkout is linked to.
+//
+// Shaped exactly like the name-before-work gate: it does not block, it teaches
+// and then gets out of the way. Repeating the same call confirms the intent and
+// the gate never fires again this process. Report-only was not enough — the
+// failure being fixed IS an agent not consulting available context, so adding
+// more context it may not read reproduces the bug with better documentation.
+//
+// Only fires when the agent named NO org: an explicit `org=` or an absolute
+// /o/<org>/... path is a deliberate address and is never second-guessed.
+let crossOrgWarned = false;
+async function getCrossOrgWriteWarning(name, args = {}) {
+  if (crossOrgWarned || mcpMode() !== 'stdio') return null;
+  if (!isMutatingToolCall(name, args)) return null;
+  if (args?.org || String(args?.path || '').startsWith('/o/')) return null;
+
+  const address = await getRepoAddress();
+  if (address.state !== 'linked') return null;
+  const current = workingOrgId();
+  if (!current || current === address.orgId) return null;
+
+  crossOrgWarned = true;
+  return [
+    `Refusing to guess the destination — this write names no org.`,
+    `Your working directory is the repo linked to ${address.path} (org "${address.org}"), but this session addresses a different org (source: ${workingOrgSource()}).`,
+    `Re-issue with the full path — e.g. ${name}(path="${address.path}/wiki/<page>") — or repeat this exact call to confirm the current org is what you meant.`,
+  ].join(' ');
+}
+
 async function getRequiredMcpUpdateError(name, args = {}) {
   if (mcpMode() !== 'stdio') return null;
   if (!isMutatingToolCall(name, args)) return null;
@@ -514,6 +545,8 @@ function tool(name, descOrSchema, schemaOrHandler, handler) {
     try {
       const requiredUpdateError = await getRequiredMcpUpdateError(name, args?.[0] || {});
       if (requiredUpdateError) return err(new Error(requiredUpdateError));
+      const crossOrgWarning = await getCrossOrgWriteWarning(name, args?.[0] || {});
+      if (crossOrgWarning) return err(new Error(crossOrgWarning));
       // Reverse the remote JSON-string encoding (see REMOTE_JSON_STRING_PARAMS)
       // so handlers receive the same object/array shapes they get on stdio.
       if (isRemote && args?.[0] && typeof args[0] === 'object') {
@@ -1072,7 +1105,29 @@ async function serverFetch(url, opts = {}) {
 // landed, so the two can never disagree.
 function workingOrgId() {
   const session = getSessionState();
-  return session.boundOrgId || session.activeProjectMeta?.orgId || getState().projectMeta?.orgId || null;
+  return session.boundOrgId
+    || session.activeProjectMeta?.orgId
+    || getState().projectMeta?.orgId
+    // Lowest rung, and only when the linked repo is UNAMBIGUOUS. It can only
+    // ever replace null — every explicit act above outranks it, so detection
+    // can never trap a session or retarget deliberate work. Null today falls
+    // through to the server session's inherited org, which is the least
+    // justified value in the chain: the user chose this checkout and linked
+    // this repo; nobody chose the inherited org.
+    || session.repoOrgId
+    || null;
+}
+
+/** Source of the value workingOrgId() returned, for echoing in whoami. Without
+ *  this, whoami reports the SERVER SESSION's org while writes are addressed by
+ *  workingOrgId() — two different values, which is how whoami can confidently
+ *  name an org a write will not go to. */
+function workingOrgSource() {
+  const session = getSessionState();
+  if (session.boundOrgId) return 'switch';
+  if (session.activeProjectMeta?.orgId || getState().projectMeta?.orgId) return 'project';
+  if (session.repoOrgId) return 'repo';
+  return 'none';
 }
 
 // One `ls` level of folders, from the org's folder list. Defined inside the
@@ -1127,7 +1182,10 @@ async function api(method, path, body, extraHeaders = {}, _retried = false, _org
   }
   const boundOrg = workingOrgId();
   const hasExplicitOrg = Object.keys(headers).some((k) => k.toLowerCase() === 'x-drafted-org');
-  if (boundOrg && !hasExplicitOrg && !path.startsWith('/auth/')) {
+  // /api/repos/resolve is exempt: it asks which org a WORKING DIRECTORY belongs
+  // to, so scoping it by the session's current org would answer a different
+  // question — and the session's org is exactly what it exists to correct.
+  if (boundOrg && !hasExplicitOrg && !path.startsWith('/auth/') && !path.startsWith('/api/repos/resolve')) {
     headers['X-Drafted-Org'] = boundOrg;
   }
   const opts = { method, headers };
@@ -2338,17 +2396,56 @@ async function getGoogleDriveAvailability() {
   }
 }
 
+// ── Repo address: which Drafted folder is this working directory? ──
+//
+// The MCP is spawned in the user's repo but never knew whether that repo was
+// linked, so an agent in a linked checkout wrote to whatever org the session
+// inherited — see the comment above workingOrgId(). This resolves the cwd to a
+// PATH (/o/<org>/<folder>), which is an address the agent can use, rather than
+// an orgId to stash, which would just be a better-sourced inherited default.
+//
+// Cached for the process: the stdio MCP has exactly one cwd, fixed at spawn.
+let repoAddressCache;
+async function getRepoAddress() {
+  if (repoAddressCache !== undefined) return repoAddressCache;
+  const probe = probeRepo();
+  // `none` means EXACTLY one thing: this is not a git checkout. It must never
+  // be the catch-all, or "I could not reach the server" is reported as "not a
+  // repo" — a confident wrong negative, which is worse than no detection.
+  if (!probe) return (repoAddressCache = { state: 'none' });
+  try {
+    const params = new URLSearchParams();
+    for (const r of probe.remotes) params.append('gitUrl', r.url);
+    if (probe.branch) params.set('branch', probe.branch);
+    // Cross-org by design, so it must NOT carry this session's org header —
+    // that is the very context we are trying to correct.
+    const out = await api('GET', `/api/repos/resolve?${params}`);
+    return (repoAddressCache = resolveAddress(probe, out?.matches || []));
+  } catch (e) {
+    // Detection never breaks a session — but it does not lie about why either,
+    // and it is NOT cached: an unauthenticated boot must re-ask once signed in.
+    return { state: 'unknown', root: probe.root, branch: probe.branch,
+             remote: probe.remotes[0]?.url ?? null, reason: e?.message || 'lookup failed' };
+  }
+}
+
 // Identity + server health: report THIS agent session's own surface identity, server
 // reachability, and installed-MCP staleness in ONE bootstrap call. The update data is
 // cached (5min), so repeat `whoami` calls are free; the server-side update gate still
 // blocks mutating calls on its own, independent of this tool. Read-only — no state changed.
-tool('whoami', 'Return THIS agent session\'s identity: its server-assigned human-readable name (the correlation key between an agent window and its web-app session tab), sessionId, userId, orgId, active projectId, editor label, server URL, and surfaced/alive state (`authState` says whether this session is signed in, and `authNote` names the exact call that fixes it when it is not — never diagnose a null userId yourself) — PLUS server health, the installed MCP version/update status (cached ~5min), and `googleDrive` — whether the working org has Google Drive connected: when `googleDrive.connected` is true, strongly prefer Google Workspace frames (.google-doc/.google-sheet/.google-slide) for docs, sheets, and decks; when false they cannot be created at all. Call once per session, right after starting, so a required update surfaces before you act on stale tool behavior. Read-only.', {}, async () => {
+tool('whoami', 'Return THIS agent session\'s identity: its server-assigned human-readable name (the correlation key between an agent window and its web-app session tab), sessionId, userId, orgId, active projectId, editor label, server URL, and surfaced/alive state (`authState` says whether this session is signed in, and `authNote` names the exact call that fixes it when it is not — never diagnose a null userId yourself) — PLUS server health, the installed MCP version/update status (cached ~5min), and `googleDrive` — whether the working org has Google Drive connected: when `googleDrive.connected` is true, strongly prefer Google Workspace frames (.google-doc/.google-sheet/.google-slide) for docs, sheets, and decks; when false they cannot be created at all. PLUS `repo` — whether your WORKING DIRECTORY is a git checkout linked to a Drafted folder, and if so its address (`/o/<org>/<folder>`): when `repo.state` is "linked", address work under `repo.path` unless the user asked otherwise, and read `repo.note`. `workingOrg` reports the org that actually ADDRESSES your requests and where it came from (`switch`/`project`/`repo`/`none`) — this is NOT always the same as `orgId`, which is the server session\'s org. Call once per session, right after starting, so a required update surfaces before you act on stale tool behavior. Read-only.', {}, async () => {
   try {
     // Ensure the child clone exists BEFORE reading identity — otherwise the /auth/me
     // fallback (pre-WS-ack) queries the ROOT session and reports the wrong naming state.
     await ensureSession();
     const block = await sessionSurfaceBlock();
-    const [mcpUpdate, googleDrive] = await Promise.all([getCachedMcpUpdateMetadata(), getGoogleDriveAvailability()]);
+    const [mcpUpdate, googleDrive, repoAddress] = await Promise.all([
+      getCachedMcpUpdateMetadata(), getGoogleDriveAvailability(), getRepoAddress(),
+    ]);
+    // Adopt an unambiguous linked repo as the lowest-precedence org. Done here
+    // rather than at connect because whoami is the bootstrap call every agent
+    // makes, and adopting can only ever fill a null (see workingOrgId).
+    if (repoAddress.state === 'linked') getSessionState().repoOrgId = repoAddress.orgId;
     // Tell the agent to actually surface its name to the user — returning `name` in the JSON isn't
     // enough; without an explicit instruction agents rarely say which session they are, so users
     // can't match them to their tab on the Drafted surface.
@@ -2377,6 +2474,10 @@ tool('whoami', 'Return THIS agent session\'s identity: its server-assigned human
       editor: (process.env.DRAFTED_AGENT_NAME || '').trim() || null,
       agentLabel: getAgentLabel(),
       googleDrive,
+      repo: { ...repoAddress, note: addressNote(repoAddress, workingOrgId()) },
+      // Echo the org that ADDRESSES requests, not the one the server session
+      // happens to hold — `block.orgId` is the latter, and the two can differ.
+      workingOrg: { orgId: workingOrgId(), source: workingOrgSource() },
       ...block,
       ...(instruction ? { instruction } : {}),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.20",
+  "version": "1.19.23",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [