drafted 1.19.27 → 1.19.28

package/mcp/server.mjs

@@ -230,6 +230,27 @@ export function projectlessMutationNeedsOrg({ explicitOrg, boundOrgId, activePro
   return (orgCount || 0) > 1;
 }
 
+// SEARCH IS STRICTER THAN A MUTATION, and deliberately so.
+//
+// A mutation credits a bound/active project as an addressing root, because the
+// destination is echoed back in the receipt: a surprising org is VISIBLE after
+// the fact. A search has no such tell. Scoping it from a binding the agent did
+// not state produces an empty result set indistinguishable from "this does not
+// exist anywhere" — the agent stops looking, and the thing it wanted was one org
+// away the whole time. A silent false negative is worse than an error, because
+// nothing about it announces itself.
+//
+// So a search must NAME where it is looking. Only two things satisfy that: an
+// org in the path (/o/<org>/...) or an explicit org= on the call. A binding does
+// not, because the point is that the CALLER declared the scope.
+//
+// Single-org users are exempt: with one org there is nothing to be fenced off
+// FROM, so the answer cannot be misleading and the friction buys nothing.
+export function searchNeedsOrg({ explicitOrg, orgFromPath, orgCount }) {
+  if (explicitOrg || orgFromPath) return false;
+  return (orgCount || 0) > 1;
+}
+
 // Did the server reject the working org THIS session injected as X-Drafted-Org?
 // A working org the caller isn't a member of can only be stale or foreign — state
 // rehydrated from another server's database, or the user removed from the org —
@@ -3160,12 +3181,12 @@ server.resource('info', 'drafted://info', {
   };
 });
 
-tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single container and the org is the folder at depth 0: `fs(ls, path="/")` lists the orgs you can address, `/o/<org>` is that org, and every folder level — the org included — carries the SAME four roots:\n\n- `<folder>/wiki/<path>` — knowledge pages (markdown, OKF; free nesting; `index.md` at any level is synthesized and read-only)\n- `<folder>/skills/<slug>` — reusable procedures (flat: one dir per skill slug, `SKILL.md` + supporting files inside; slugs stay unique per ORG, so a skill resolves by slug from anywhere)\n- `<folder>/tasks/<lane?>/<file>` — work items. A task IS a frame: `read` renders its `drafted:status:`/`drafted:assignee:` as front matter and `write`/`edit` parse them back into columns, so they are never stored in the body. The keys are namespaced so an ordinary `status:` in your own front matter is left alone. Valid statuses: open, in_progress, scheduled, needs_review, needs_decision, done, failed (an empty `drafted:status:` clears it). Status is a column, not a location — a task moved out of /tasks stays a task.\n- `<folder>/projects/<project>/<layer>/<lane>/<file>` — producible frames (then exactly layer → lane → file)\n\nFolders nest arbitrarily: `/o/<org>/engineering/backend/wiki/deploy`. The ROOT KEYWORD IS THE SEPARATOR — everything before `wiki`/`skills`/`tasks`/`projects` is the folder chain, everything after is the path inside that root, so `/o/<org>/wiki/engineering/foo` (the org wiki, nested page) and `/o/<org>/engineering/wiki/foo` (the engineering folder\'s wiki) are different pages. The four names are therefore RESERVED: a folder cannot be called one. `fs(ls, path="/o/<org>/<folder>")` shows a folder\'s four roots plus the folders inside it; `fs(mkdir, path="/o/<org>/<folder>")` creates one.\n\n(Bare `/wiki`, `/skills`, `/tasks`, `/projects` roots still resolve via the session\'s working org, at that org\'s root.)\n\nVerbs: `ls` (list a directory), `read` (file content — hashline-annotated for text so `edit` stays surgical), `write` (create/overwrite; extension + layer classify the type: .html design, .md document, .excalidraw diagram, .xlsx/.docx office, images/videos media, .pdf asset, .google-doc/.google-sheet/.google-slide create native Google Workspace files), `edit` (hashline ops for text, element ops for excalidraw, structured ops for office), `mv` (rename/move, cross-project), `rm` (delete), `search` (frames are searched by label AND content, with the matching line returned as a snippet; `fs(search, path="/")` or `path="/o/<org>"` fans out across wiki + skills + projects in one call), `link` / `unlink` / `links` (relate one frame to another frame, to a project, or to an external url — `links` lists a frame\'s edges plus its backlinks, and on a project path lists the tasks linked to that project; a link is stored by ID, so `mv` never breaks it). `mkdir` creates a project only: use `/projects/<project>` or `/projects/<folder>/<project>`, never a layer path. To create a layer, write its first frame at `/projects/<project>/<new-layer>/<lane>/<file>`.\n\nThe project is resolved from the path itself — no separate "open" step. Guardrails are server-side and unchanged: the org in the path must be the project\'s own org (project paths under /o/<org>/ validate it), the G1 wiki-search gate fires before project mutations, attached-skill gates fire on mutations, anchored frames must be read before editing a layer, `.skillinstall/` is stripped on skill push.', {
+tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single container and the org is the folder at depth 0: `fs(ls, path="/")` lists the orgs you can address, `/o/<org>` is that org, and every folder level — the org included — carries the SAME four roots:\n\n- `<folder>/wiki/<path>` — knowledge pages (markdown, OKF; free nesting; `index.md` at any level is synthesized and read-only)\n- `<folder>/skills/<slug>` — reusable procedures (flat: one dir per skill slug, `SKILL.md` + supporting files inside; slugs stay unique per ORG, so a skill resolves by slug from anywhere)\n- `<folder>/tasks/<lane?>/<file>` — work items. A task IS a frame: `read` renders its `drafted:status:`/`drafted:assignee:` as front matter and `write`/`edit` parse them back into columns, so they are never stored in the body. The keys are namespaced so an ordinary `status:` in your own front matter is left alone. Valid statuses: open, in_progress, scheduled, needs_review, needs_decision, done, failed (an empty `drafted:status:` clears it). Status is a column, not a location — a task moved out of /tasks stays a task.\n- `<folder>/projects/<project>/<layer>/<lane>/<file>` — producible frames (then exactly layer → lane → file)\n\nFolders nest arbitrarily: `/o/<org>/engineering/backend/wiki/deploy`. The ROOT KEYWORD IS THE SEPARATOR — everything before `wiki`/`skills`/`tasks`/`projects` is the folder chain, everything after is the path inside that root, so `/o/<org>/wiki/engineering/foo` (the org wiki, nested page) and `/o/<org>/engineering/wiki/foo` (the engineering folder\'s wiki) are different pages. The four names are therefore RESERVED: a folder cannot be called one. `fs(ls, path="/o/<org>/<folder>")` shows a folder\'s four roots plus the folders inside it; `fs(mkdir, path="/o/<org>/<folder>")` creates one.\n\n(Bare `/wiki`, `/skills`, `/tasks`, `/projects` roots still resolve via the session\'s working org, at that org\'s root.)\n\nVerbs: `ls` (list a directory), `read` (file content — hashline-annotated for text so `edit` stays surgical), `write` (create/overwrite; extension + layer classify the type: .html design, .md document, .excalidraw diagram, .xlsx/.docx office, images/videos media, .pdf asset, .google-doc/.google-sheet/.google-slide create native Google Workspace files), `edit` (hashline ops for text, element ops for excalidraw, structured ops for office), `mv` (rename/move, cross-project), `rm` (delete), `search` (frames are searched by label AND content, with the matching line returned as a snippet; `fs(search, path="/o/<org>")` fans out across wiki + skills + projects in one call. SEARCH MUST NAME ITS ORG — put it in the path, or pass org=. If you belong to more than one org an unaddressed search is REFUSED rather than silently scoped, because "no matches" from one org is indistinguishable from "nowhere" and you would stop looking. Search several orgs with one call each; every result says which org it came from), `link` / `unlink` / `links` (relate one frame to another frame, to a project, or to an external url — `links` lists a frame\'s edges plus its backlinks, and on a project path lists the tasks linked to that project; a link is stored by ID, so `mv` never breaks it). `mkdir` creates a project only: use `/projects/<project>` or `/projects/<folder>/<project>`, never a layer path. To create a layer, write its first frame at `/projects/<project>/<new-layer>/<lane>/<file>`.\n\nThe project is resolved from the path itself — no separate "open" step. Guardrails are server-side and unchanged: the org in the path must be the project\'s own org (project paths under /o/<org>/ validate it), the G1 wiki-search gate fires before project mutations, attached-skill gates fire on mutations, anchored frames must be read before editing a layer, `.skillinstall/` is stripped on skill push.', {
   action: z.enum(['ls', 'read', 'write', 'edit', 'mv', 'rm', 'mkdir', 'search', 'link', 'unlink', 'links']).describe('Filesystem verb.'),
   path: z.string().describe('Drafted path: /o/<org>[/<folder…>]/wiki/... | .../skills/... | .../tasks/... | .../projects/... — a folder chain may precede any root (bare /wiki, /skills, /tasks, /projects also work; for mv: source)'),
   to: z.string().optional().describe('[mv] destination path; [link/unlink] target path — a frame path, or a project path (/o/<org>/projects/<project>) to link a task to a project'),
   url: z.string().optional().describe('[link/unlink] external target URL, instead of `to` (a link is internal-by-id OR external-by-url, never both)'),
-  query: z.string().optional().describe('[search] term to match against names/content'),
+  query: z.string().optional().describe('[search] term to match against names/content. The path must name an org (/o/<org>) unless you belong to exactly one.'),
   content: z.string().optional().describe('[write] inline HTML/markdown/text'),
   file_path: z.string().optional().describe('[write] absolute path to a local file to upload (stdio only). Under /projects it uploads bytes (images, PDFs, office files); under /wiki and /skills it reads the file as UTF-8 text, so a markdown file on disk can be written straight to a page or a SKILL.md without pasting it.'),
   base64: z.string().optional().describe('[write] base64-encoded binary content'),
@@ -3234,14 +3255,33 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
     // three inventories. A leg that fails says so instead of reading as zero hits.
     if (action === 'search') {
       const q = String(query || '').trim();
-      if (!q) return err(new Error('search requires a query — e.g. fs(search, path="/", query="<terms>")'));
+      if (!q) return err(new Error('search requires a query — e.g. fs(search, path="/o/<org>", query="<terms>")'));
+      // Name the org, or don't search. See searchNeedsOrg: an unaddressed search
+      // returns "no matches" from ONE org and reads as "nowhere", which is the
+      // one wrong answer a search can give that nothing announces.
+      {
+        const orgs = await getOrgList();
+        if (searchNeedsOrg({ explicitOrg: org, orgFromPath, orgCount: orgs.length })) {
+          const names = orgs.map(o => o.slug || o.name || o.id).filter(Boolean);
+          return err(new Error(
+            `Which org? Search needs one, and you belong to ${orgs.length}: ${names.join(', ')}.\n` +
+            `An unaddressed search would scope to whichever org this session inherited and report ` +
+            `"no matches" for the others — a false negative you cannot see, which is worse than this error.\n` +
+            `Address the org in the PATH: fs(search, path="/o/<org>", query="${q}").\n` +
+            `(Or org="<name>" on this call. Searching several orgs = one call each; the results say which org they came from.)`
+          ));
+        }
+      }
       const scope = orgFromPath ? `/o/${orgFromPath}` : '';
       const leg = async (fn) => { try { return { v: await fn() }; } catch (e) { return { e: e?.message || String(e) }; } };
       const [wiki, skills, projects, frames] = await Promise.all([
         leg(() => api('GET', `/api/wiki/search?q=${encodeURIComponent(q)}&limit=10`, undefined, orgHeader)),
         leg(() => api('GET', `/api/skills/search?q=${encodeURIComponent(q)}`, undefined, orgHeader)),
         leg(() => api('GET', '/api/projects', undefined, orgHeader)),
-        leg(() => withoutProjectScope(() => api('GET', `/api/search?q=${encodeURIComponent(q)}&limit=15`))),
+        // orgHeader, so the server scopes frames instead of us filtering after the
+        // fact — the row cap is applied server-side, so a client-side filter can be
+        // handed a page already filled by other orgs' hits.
+        leg(() => withoutProjectScope(() => api('GET', `/api/search?q=${encodeURIComponent(q)}&limit=15`, undefined, orgHeader))),
       ]);
       // A root search IS the prior-art search both gates ask for — it read the wiki
       // and the skill library. Not crediting it would send the agent back to run
@@ -3285,7 +3325,10 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
         return hits.length ? formatFrameHits(hits, { limit: 15 }) + note : (note ? note.trimStart() : '');
       });
 
-      return ok(`Search "${q}"${orgFromPath ? ` in /o/${orgFromPath}` : ''}\n\n${out.join('\n\n')}`);
+      const searched = orgFromPath || org || null;
+      // ALWAYS say where this looked. "No matches" is only safe to act on when
+      // the reader can see the scope it was computed over.
+      return ok(`Search "${q}" in ${searched ? `/o/${searched}` : 'your only org'}\n\n${out.join('\n\n')}`);
     }
     if (action !== 'ls') return err(new Error('read/write/edit/mv/rm require a path under /o/<org>/wiki, /o/<org>/skills, /o/<org>/tasks, or /o/<org>/projects'));
     if (orgFromPath) {

package/mcp/test-org-guards.mjs

@@ -181,4 +181,30 @@ assert.equal(rmScope(null, null, null), 'project', 'only the bare project path a
 console.log('org-guard policy OK');
 // Importing server.mjs builds the stdio MCP singleton, which opens a WS reconnect
 // loop that keeps the event loop alive. Assertions are done — exit deterministically.
-process.exit(0);
+// ── searchNeedsOrg: stricter than a mutation, on purpose ───────────
+// A mutation credits a bound project because its receipt names the destination.
+// A search has no such tell: scoping it from an unstated binding yields an empty
+// result the agent reads as "does not exist anywhere". Only a NAMED org counts.
+{
+  const { searchNeedsOrg } = await import('./server.mjs');
+  const t = (label, args, expected) => {
+    const got = searchNeedsOrg(args);
+    if (got !== expected) {
+      console.error(`FAIL searchNeedsOrg: ${label} -> ${got}, expected ${expected}`);
+      process.exitCode = 1;
+    } else console.log(`ok  searchNeedsOrg: ${label}`);
+  };
+
+  t('multi-org, nothing named -> REFUSE', { orgCount: 3 }, true);
+  t('org in the path -> proceed', { orgFromPath: 'beoflow', orgCount: 3 }, false);
+  t('explicit org= -> proceed', { explicitOrg: 'beoflow', orgCount: 3 }, false);
+  t('single org -> proceed (nothing to be fenced from)', { orgCount: 1 }, false);
+  t('zero/unknown orgs -> proceed, never block on unknown membership', { orgCount: 0 }, false);
+  // The divergence from the mutation rule is the whole point: a binding does NOT
+  // satisfy a search, because the caller never stated the scope.
+  t('bound project does NOT satisfy a search', { activeProjectId: 'p1', boundOrgId: 'o1', orgCount: 2 }, true);
+}
+
+// Must exit: importing server.mjs opens the MCP WebSocket at module scope and
+// pins the event loop (AGENTS.md).
+process.exit(process.exitCode || 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.27",
+  "version": "1.19.28",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [