drafted 1.19.26 → 1.19.28

package/mcp/server.mjs

@@ -230,6 +230,27 @@ export function projectlessMutationNeedsOrg({ explicitOrg, boundOrgId, activePro
   return (orgCount || 0) > 1;
 }
 
+// SEARCH IS STRICTER THAN A MUTATION, and deliberately so.
+//
+// A mutation credits a bound/active project as an addressing root, because the
+// destination is echoed back in the receipt: a surprising org is VISIBLE after
+// the fact. A search has no such tell. Scoping it from a binding the agent did
+// not state produces an empty result set indistinguishable from "this does not
+// exist anywhere" — the agent stops looking, and the thing it wanted was one org
+// away the whole time. A silent false negative is worse than an error, because
+// nothing about it announces itself.
+//
+// So a search must NAME where it is looking. Only two things satisfy that: an
+// org in the path (/o/<org>/...) or an explicit org= on the call. A binding does
+// not, because the point is that the CALLER declared the scope.
+//
+// Single-org users are exempt: with one org there is nothing to be fenced off
+// FROM, so the answer cannot be misleading and the friction buys nothing.
+export function searchNeedsOrg({ explicitOrg, orgFromPath, orgCount }) {
+  if (explicitOrg || orgFromPath) return false;
+  return (orgCount || 0) > 1;
+}
+
 // Did the server reject the working org THIS session injected as X-Drafted-Org?
 // A working org the caller isn't a member of can only be stale or foreign — state
 // rehydrated from another server's database, or the user removed from the org —
@@ -2106,6 +2127,51 @@ function desktopAppBinary() {
   return null; // e.g. Linux — no desktop app → device-code fallback
 }
 
+/**
+ * The answer to "am I signed in?", which is a question about the MACHINE, not this
+ * process. Two things went wrong before this existed, and they are the same mistake:
+ *
+ *  - ~/.drafted/auth.json could be missing while the in-process session was fine. The
+ *    desktop's credential burn deletes it on purpose, so `login` answered
+ *    already_authenticated — truthfully, and uselessly — while every other reader on the
+ *    machine stayed signed out. Restore it from the live session.
+ *  - The DESKTOP app could be signed out, which is what actually decides whether an agent
+ *    asking for a human reaches anybody: its focus listener needs desktop.json. An agent
+ *    must never MINT that credential (origin='browser' is the class that may approve
+ *    actions), but opening the app's sign-in window is this tool's documented job — and it
+ *    usually completes with NO interaction, because the shared cookie store still holds a
+ *    valid login.
+ */
+async function alreadyAuthenticated(me, sessionId) {
+  const out = { status: 'already_authenticated', userId: me.userId, email: me.userEmail, org: me.currentOrg?.name };
+  if (!getBootstrapSessionId()) {
+    try {
+      persistAuthSession({ sessionId, userId: me.userId, orgId: me.currentOrg?.id });
+      out.restoredAuthFile = true;
+      out.note = 'This session was signed in but ~/.drafted/auth.json was missing, so other readers on this machine (the desktop app, the CLI) were not. Rewrote it from the live session.';
+    } catch { /* read-only home: report the truth rather than throwing */ }
+  }
+  const bin = desktopAppBinary();
+  if (!bin) return out;                       // no app here: saying anything about it is noise
+  if (!existsSync(DESKTOP_SESSION_FILE)) {
+    if (await launchDesktopSignin()) {
+      out.openedDesktopSignin = true;
+      // Wait for the result rather than reporting an optimistic one — answering before it
+      // lands is the same class of lie this whole helper exists to stop.
+      for (let i = 0; i < 20 && !existsSync(DESKTOP_SESSION_FILE); i++) {
+        await new Promise((r) => setTimeout(r, 500));
+      }
+    }
+  }
+  out.desktopSignedIn = existsSync(DESKTOP_SESSION_FILE);
+  if (out.openedDesktopSignin) {
+    out.desktopNote = out.desktopSignedIn
+      ? 'The desktop app was signed out; opened its sign-in window and it completed on its own from the existing browser session.'
+      : 'The desktop app is signed out and its sign-in window is open — it needs one approval there. Until then it holds no session, so an agent asking for attention cannot reach this machine.';
+  }
+  return out;
+}
+
 async function launchDesktopSignin() {
   const bin = desktopAppBinary();
   if (!bin) return false;
@@ -2186,7 +2252,7 @@ if (!isRemote) tool('auth', 'Sign in to Drafted.\n\n`action=get_link` ALWAYS ret
               await cloneSession();
               connectAgentWs();
             }
-            return ok({ status: 'already_authenticated', userId: me.userId, email: me.userEmail, org: me.currentOrg?.name });
+            return ok(await alreadyAuthenticated(me, existing));
           }
         } catch { /* stale session — continue to sign-in */ }
       }
@@ -2232,51 +2298,7 @@ if (!isRemote) tool('auth', 'Sign in to Drafted.\n\n`action=get_link` ALWAYS ret
             // The desktop's focus listener is one of those readers, so an agent asking
             // for a human reached nobody and the tool that exists to fix it reported
             // success.
-            let restoredAuthFile = false;
-            if (!getBootstrapSessionId()) {
-              try {
-                persistAuthSession({ sessionId: existing, userId: me.userId, orgId: me.currentOrg?.id });
-                restoredAuthFile = true;
-              } catch { /* read-only home: report the truth below rather than throwing */ }
-            }
-            // The DESKTOP's own browser credential is a separate file, and an agent
-            // cannot mint one — it is the origin='browser' class that may approve
-            // actions, which is exactly what the two-credential split protects. But
-            // "cannot mint it" is not "cannot ask for it": opening the app's sign-in
-            // window is this tool's documented job, and the window usually completes
-            // with no interaction at all because the shared cookie store still holds a
-            // valid login. Short-circuiting on the agent session skipped that entirely,
-            // so `login` reported success while the app stayed signed out and every
-            // agent that pinged the human reached nobody.
-            let openedDesktopSignin = false;
-            if (desktopAppBinary() && !existsSync(DESKTOP_SESSION_FILE)) {
-              openedDesktopSignin = await launchDesktopSignin();
-              if (openedDesktopSignin) {
-                // Give the app a moment to re-capture the cookie so the caller can act
-                // on a true answer rather than an optimistic one.
-                for (let i = 0; i < 20 && !existsSync(DESKTOP_SESSION_FILE); i++) {
-                  await new Promise((r) => setTimeout(r, 500));
-                }
-              }
-            }
-            const desktopSignedIn = !desktopAppBinary() ? null : existsSync(DESKTOP_SESSION_FILE);
-            return ok({
-              status: 'already_authenticated',
-              userId: me.userId,
-              email: me.userEmail,
-              org: me.currentOrg?.name,
-              ...(restoredAuthFile ? {
-                restoredAuthFile: true,
-                note: 'This session was signed in but ~/.drafted/auth.json was missing, so other readers on this machine (the desktop app, the CLI) were not. Rewrote it from the live session.',
-              } : {}),
-              ...(desktopSignedIn === null ? {} : { desktopSignedIn }),
-              ...(openedDesktopSignin ? {
-                openedDesktopSignin: true,
-                desktopNote: desktopSignedIn
-                  ? 'The desktop app was signed out; opened its sign-in window and it completed on its own from the existing browser session.'
-                  : 'The desktop app is signed out and its sign-in window is open — it needs one approval there. Until then it holds no session, so an agent asking for attention cannot reach this machine.',
-              } : {}),
-            });
+            return ok(await alreadyAuthenticated(me, existing));
           }
         } catch { /* session invalid, proceed with login */ }
       }
@@ -3159,12 +3181,12 @@ server.resource('info', 'drafted://info', {
   };
 });
 
-tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single container and the org is the folder at depth 0: `fs(ls, path="/")` lists the orgs you can address, `/o/<org>` is that org, and every folder level — the org included — carries the SAME four roots:\n\n- `<folder>/wiki/<path>` — knowledge pages (markdown, OKF; free nesting; `index.md` at any level is synthesized and read-only)\n- `<folder>/skills/<slug>` — reusable procedures (flat: one dir per skill slug, `SKILL.md` + supporting files inside; slugs stay unique per ORG, so a skill resolves by slug from anywhere)\n- `<folder>/tasks/<lane?>/<file>` — work items. A task IS a frame: `read` renders its `drafted:status:`/`drafted:assignee:` as front matter and `write`/`edit` parse them back into columns, so they are never stored in the body. The keys are namespaced so an ordinary `status:` in your own front matter is left alone. Valid statuses: open, in_progress, scheduled, needs_review, needs_decision, done, failed (an empty `drafted:status:` clears it). Status is a column, not a location — a task moved out of /tasks stays a task.\n- `<folder>/projects/<project>/<layer>/<lane>/<file>` — producible frames (then exactly layer → lane → file)\n\nFolders nest arbitrarily: `/o/<org>/engineering/backend/wiki/deploy`. The ROOT KEYWORD IS THE SEPARATOR — everything before `wiki`/`skills`/`tasks`/`projects` is the folder chain, everything after is the path inside that root, so `/o/<org>/wiki/engineering/foo` (the org wiki, nested page) and `/o/<org>/engineering/wiki/foo` (the engineering folder\'s wiki) are different pages. The four names are therefore RESERVED: a folder cannot be called one. `fs(ls, path="/o/<org>/<folder>")` shows a folder\'s four roots plus the folders inside it; `fs(mkdir, path="/o/<org>/<folder>")` creates one.\n\n(Bare `/wiki`, `/skills`, `/tasks`, `/projects` roots still resolve via the session\'s working org, at that org\'s root.)\n\nVerbs: `ls` (list a directory), `read` (file content — hashline-annotated for text so `edit` stays surgical), `write` (create/overwrite; extension + layer classify the type: .html design, .md document, .excalidraw diagram, .xlsx/.docx office, images/videos media, .pdf asset, .google-doc/.google-sheet/.google-slide create native Google Workspace files), `edit` (hashline ops for text, element ops for excalidraw, structured ops for office), `mv` (rename/move, cross-project), `rm` (delete), `search` (frames are searched by label AND content, with the matching line returned as a snippet; `fs(search, path="/")` or `path="/o/<org>"` fans out across wiki + skills + projects in one call), `link` / `unlink` / `links` (relate one frame to another frame, to a project, or to an external url — `links` lists a frame\'s edges plus its backlinks, and on a project path lists the tasks linked to that project; a link is stored by ID, so `mv` never breaks it). `mkdir` creates a project only: use `/projects/<project>` or `/projects/<folder>/<project>`, never a layer path. To create a layer, write its first frame at `/projects/<project>/<new-layer>/<lane>/<file>`.\n\nThe project is resolved from the path itself — no separate "open" step. Guardrails are server-side and unchanged: the org in the path must be the project\'s own org (project paths under /o/<org>/ validate it), the G1 wiki-search gate fires before project mutations, attached-skill gates fire on mutations, anchored frames must be read before editing a layer, `.skillinstall/` is stripped on skill push.', {
+tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single container and the org is the folder at depth 0: `fs(ls, path="/")` lists the orgs you can address, `/o/<org>` is that org, and every folder level — the org included — carries the SAME four roots:\n\n- `<folder>/wiki/<path>` — knowledge pages (markdown, OKF; free nesting; `index.md` at any level is synthesized and read-only)\n- `<folder>/skills/<slug>` — reusable procedures (flat: one dir per skill slug, `SKILL.md` + supporting files inside; slugs stay unique per ORG, so a skill resolves by slug from anywhere)\n- `<folder>/tasks/<lane?>/<file>` — work items. A task IS a frame: `read` renders its `drafted:status:`/`drafted:assignee:` as front matter and `write`/`edit` parse them back into columns, so they are never stored in the body. The keys are namespaced so an ordinary `status:` in your own front matter is left alone. Valid statuses: open, in_progress, scheduled, needs_review, needs_decision, done, failed (an empty `drafted:status:` clears it). Status is a column, not a location — a task moved out of /tasks stays a task.\n- `<folder>/projects/<project>/<layer>/<lane>/<file>` — producible frames (then exactly layer → lane → file)\n\nFolders nest arbitrarily: `/o/<org>/engineering/backend/wiki/deploy`. The ROOT KEYWORD IS THE SEPARATOR — everything before `wiki`/`skills`/`tasks`/`projects` is the folder chain, everything after is the path inside that root, so `/o/<org>/wiki/engineering/foo` (the org wiki, nested page) and `/o/<org>/engineering/wiki/foo` (the engineering folder\'s wiki) are different pages. The four names are therefore RESERVED: a folder cannot be called one. `fs(ls, path="/o/<org>/<folder>")` shows a folder\'s four roots plus the folders inside it; `fs(mkdir, path="/o/<org>/<folder>")` creates one.\n\n(Bare `/wiki`, `/skills`, `/tasks`, `/projects` roots still resolve via the session\'s working org, at that org\'s root.)\n\nVerbs: `ls` (list a directory), `read` (file content — hashline-annotated for text so `edit` stays surgical), `write` (create/overwrite; extension + layer classify the type: .html design, .md document, .excalidraw diagram, .xlsx/.docx office, images/videos media, .pdf asset, .google-doc/.google-sheet/.google-slide create native Google Workspace files), `edit` (hashline ops for text, element ops for excalidraw, structured ops for office), `mv` (rename/move, cross-project), `rm` (delete), `search` (frames are searched by label AND content, with the matching line returned as a snippet; `fs(search, path="/o/<org>")` fans out across wiki + skills + projects in one call. SEARCH MUST NAME ITS ORG — put it in the path, or pass org=. If you belong to more than one org an unaddressed search is REFUSED rather than silently scoped, because "no matches" from one org is indistinguishable from "nowhere" and you would stop looking. Search several orgs with one call each; every result says which org it came from), `link` / `unlink` / `links` (relate one frame to another frame, to a project, or to an external url — `links` lists a frame\'s edges plus its backlinks, and on a project path lists the tasks linked to that project; a link is stored by ID, so `mv` never breaks it). `mkdir` creates a project only: use `/projects/<project>` or `/projects/<folder>/<project>`, never a layer path. To create a layer, write its first frame at `/projects/<project>/<new-layer>/<lane>/<file>`.\n\nThe project is resolved from the path itself — no separate "open" step. Guardrails are server-side and unchanged: the org in the path must be the project\'s own org (project paths under /o/<org>/ validate it), the G1 wiki-search gate fires before project mutations, attached-skill gates fire on mutations, anchored frames must be read before editing a layer, `.skillinstall/` is stripped on skill push.', {
   action: z.enum(['ls', 'read', 'write', 'edit', 'mv', 'rm', 'mkdir', 'search', 'link', 'unlink', 'links']).describe('Filesystem verb.'),
   path: z.string().describe('Drafted path: /o/<org>[/<folder…>]/wiki/... | .../skills/... | .../tasks/... | .../projects/... — a folder chain may precede any root (bare /wiki, /skills, /tasks, /projects also work; for mv: source)'),
   to: z.string().optional().describe('[mv] destination path; [link/unlink] target path — a frame path, or a project path (/o/<org>/projects/<project>) to link a task to a project'),
   url: z.string().optional().describe('[link/unlink] external target URL, instead of `to` (a link is internal-by-id OR external-by-url, never both)'),
-  query: z.string().optional().describe('[search] term to match against names/content'),
+  query: z.string().optional().describe('[search] term to match against names/content. The path must name an org (/o/<org>) unless you belong to exactly one.'),
   content: z.string().optional().describe('[write] inline HTML/markdown/text'),
   file_path: z.string().optional().describe('[write] absolute path to a local file to upload (stdio only). Under /projects it uploads bytes (images, PDFs, office files); under /wiki and /skills it reads the file as UTF-8 text, so a markdown file on disk can be written straight to a page or a SKILL.md without pasting it.'),
   base64: z.string().optional().describe('[write] base64-encoded binary content'),
@@ -3233,14 +3255,33 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
     // three inventories. A leg that fails says so instead of reading as zero hits.
     if (action === 'search') {
       const q = String(query || '').trim();
-      if (!q) return err(new Error('search requires a query — e.g. fs(search, path="/", query="<terms>")'));
+      if (!q) return err(new Error('search requires a query — e.g. fs(search, path="/o/<org>", query="<terms>")'));
+      // Name the org, or don't search. See searchNeedsOrg: an unaddressed search
+      // returns "no matches" from ONE org and reads as "nowhere", which is the
+      // one wrong answer a search can give that nothing announces.
+      {
+        const orgs = await getOrgList();
+        if (searchNeedsOrg({ explicitOrg: org, orgFromPath, orgCount: orgs.length })) {
+          const names = orgs.map(o => o.slug || o.name || o.id).filter(Boolean);
+          return err(new Error(
+            `Which org? Search needs one, and you belong to ${orgs.length}: ${names.join(', ')}.\n` +
+            `An unaddressed search would scope to whichever org this session inherited and report ` +
+            `"no matches" for the others — a false negative you cannot see, which is worse than this error.\n` +
+            `Address the org in the PATH: fs(search, path="/o/<org>", query="${q}").\n` +
+            `(Or org="<name>" on this call. Searching several orgs = one call each; the results say which org they came from.)`
+          ));
+        }
+      }
       const scope = orgFromPath ? `/o/${orgFromPath}` : '';
       const leg = async (fn) => { try { return { v: await fn() }; } catch (e) { return { e: e?.message || String(e) }; } };
       const [wiki, skills, projects, frames] = await Promise.all([
         leg(() => api('GET', `/api/wiki/search?q=${encodeURIComponent(q)}&limit=10`, undefined, orgHeader)),
         leg(() => api('GET', `/api/skills/search?q=${encodeURIComponent(q)}`, undefined, orgHeader)),
         leg(() => api('GET', '/api/projects', undefined, orgHeader)),
-        leg(() => withoutProjectScope(() => api('GET', `/api/search?q=${encodeURIComponent(q)}&limit=15`))),
+        // orgHeader, so the server scopes frames instead of us filtering after the
+        // fact — the row cap is applied server-side, so a client-side filter can be
+        // handed a page already filled by other orgs' hits.
+        leg(() => withoutProjectScope(() => api('GET', `/api/search?q=${encodeURIComponent(q)}&limit=15`, undefined, orgHeader))),
       ]);
       // A root search IS the prior-art search both gates ask for — it read the wiki
       // and the skill library. Not crediting it would send the agent back to run
@@ -3284,7 +3325,10 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
         return hits.length ? formatFrameHits(hits, { limit: 15 }) + note : (note ? note.trimStart() : '');
       });
 
-      return ok(`Search "${q}"${orgFromPath ? ` in /o/${orgFromPath}` : ''}\n\n${out.join('\n\n')}`);
+      const searched = orgFromPath || org || null;
+      // ALWAYS say where this looked. "No matches" is only safe to act on when
+      // the reader can see the scope it was computed over.
+      return ok(`Search "${q}" in ${searched ? `/o/${searched}` : 'your only org'}\n\n${out.join('\n\n')}`);
     }
     if (action !== 'ls') return err(new Error('read/write/edit/mv/rm require a path under /o/<org>/wiki, /o/<org>/skills, /o/<org>/tasks, or /o/<org>/projects'));
     if (orgFromPath) {

package/mcp/test-org-guards.mjs

@@ -181,4 +181,30 @@ assert.equal(rmScope(null, null, null), 'project', 'only the bare project path a
 console.log('org-guard policy OK');
 // Importing server.mjs builds the stdio MCP singleton, which opens a WS reconnect
 // loop that keeps the event loop alive. Assertions are done — exit deterministically.
-process.exit(0);
+// ── searchNeedsOrg: stricter than a mutation, on purpose ───────────
+// A mutation credits a bound project because its receipt names the destination.
+// A search has no such tell: scoping it from an unstated binding yields an empty
+// result the agent reads as "does not exist anywhere". Only a NAMED org counts.
+{
+  const { searchNeedsOrg } = await import('./server.mjs');
+  const t = (label, args, expected) => {
+    const got = searchNeedsOrg(args);
+    if (got !== expected) {
+      console.error(`FAIL searchNeedsOrg: ${label} -> ${got}, expected ${expected}`);
+      process.exitCode = 1;
+    } else console.log(`ok  searchNeedsOrg: ${label}`);
+  };
+
+  t('multi-org, nothing named -> REFUSE', { orgCount: 3 }, true);
+  t('org in the path -> proceed', { orgFromPath: 'beoflow', orgCount: 3 }, false);
+  t('explicit org= -> proceed', { explicitOrg: 'beoflow', orgCount: 3 }, false);
+  t('single org -> proceed (nothing to be fenced from)', { orgCount: 1 }, false);
+  t('zero/unknown orgs -> proceed, never block on unknown membership', { orgCount: 0 }, false);
+  // The divergence from the mutation rule is the whole point: a binding does NOT
+  // satisfy a search, because the caller never stated the scope.
+  t('bound project does NOT satisfy a search', { activeProjectId: 'p1', boundOrgId: 'o1', orgCount: 2 }, true);
+}
+
+// Must exit: importing server.mjs opens the MCP WebSocket at module scope and
+// pins the event loop (AGENTS.md).
+process.exit(process.exitCode || 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.26",
+  "version": "1.19.28",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [