drafted 1.19.35 → 1.19.36

package/mcp/server.mjs

@@ -19,7 +19,7 @@ import { z } from 'zod';
 import { registerAppResource, RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/server';
 import WebSocket from 'ws';
 import { LAYERS } from '../src/shared/constants.mjs';
-import { liftFolderScope, rootEntries, subfolderEntries } from '../src/shared/folder-path.mjs';
+import { liftFolderScope, normalizeFolder, rootEntries, subfolderEntries } from '../src/shared/folder-path.mjs';
 import { emptyExcalidrawScene, stringifyExcalidrawScene } from '../src/shared/excalidraw.mjs';
 import { formatOkfLogEntry, appendOkfLogEntry } from '../src/shared/okf-log.mjs';
 import { createGateState, markSearched, g1Block, g2Block, g3Block, selectWithinBudget, wouldExceedBudget, budgetError, formatWikiIndex, formatProjectIndex, projectPath, PROJECT_CONTEXT_BUDGET_CHARS } from './gates.mjs';
@@ -211,6 +211,28 @@ export function rmScope(layer, lane, filename) {
   return 'project';
 }
 
+// The segments AFTER the project in an fs path: '' | layer | layer/lane |
+// layer/file | layer/lane/file. A trailing segment with an extension is a
+// layer-root file, one without is a lane — mirroring the server's dual routes;
+// the excluded names are layers, which would otherwise read as files.
+//
+// Top-level and exported for the same reason as rmScope: it is the whole parse,
+// it is pure, and it used to be positional guesswork spread across four
+// `parts.length ===` branches that silently mis-read every folder-qualified path.
+export function splitProjectTail(tail) {
+  if (tail.length === 0) return { layer: undefined, lane: null, filename: null };
+  if (tail.length === 1) return { layer: tail[0], lane: null, filename: null };
+  if (tail.length === 2) {
+    const last = tail[1];
+    const isFile = /\.[a-z0-9]+$/i.test(last)
+      && !['designs', 'research', 'plans', 'copy', 'wireframes', 'images', 'components', 'brand-assets'].includes(last);
+    return isFile
+      ? { layer: tail[0], lane: null, filename: last }
+      : { layer: tail[0], lane: last, filename: null };
+  }
+  return { layer: tail[tail.length - 3], lane: tail[tail.length - 2], filename: tail[tail.length - 1] };
+}
+
 // ── Org-ambiguity policy (the one decision core) ─────────────────
 // The org guard inside the factory plumbs session/HTTP state into this
 // side-effect-free predicate, which IS the policy (DRAFT-36 "one rule"). Top-level
@@ -1556,12 +1578,42 @@ async function resolveProjectRef(ref) {
     list.find(x => String(x.slug || '').toLowerCase() === want) ||
     list.find(x => String(x.name || '').toLowerCase() === want);
   if (!p) return null;
-  const meta = { id: p.id, slug: p.slug || null, name: p.name || null, orgId: p.orgId || null, orgSlug: p.orgSlug || null };
+  // `folder` rides along so a caller can rebuild the project's printed address
+  // (/o/<org>/projects/<folder>/<slug>) without a second lookup.
+  const meta = { id: p.id, slug: p.slug || null, name: p.name || null, orgId: p.orgId || null, orgSlug: p.orgSlug || null, folder: p.folder || '' };
   projectRefCache.set(ref, meta);
   projectRefCache.set(p.id, meta);
   return meta;
 }
 
+/**
+ * Find the project in a FOLDER-QUALIFIED path — the form fs(ls) prints,
+ * /projects/<folder...>/<project>/... — by locating the first segment that names
+ * a project WHOSE FOLDER is the segments before it. Checking the folder is what
+ * keeps this from turning a typo into a wrong project: `/projects/Marketing/x`
+ * resolves only if `x` really lives in Marketing.
+ *
+ * One /api/projects fetch for the whole scan, not one per candidate.
+ */
+async function resolveFolderQualifiedProject(parts) {
+  const data = await api('GET', '/api/projects').catch(() => null);
+  const list = Array.isArray(data?.projects) ? data.projects : [];
+  const norm = (s) => String(s || '').toLowerCase();
+  for (let i = 1; i < parts.length; i++) {
+    const want = norm(parts[i]);
+    const folderRef = norm(parts.slice(0, i).join('/'));
+    const p = list.find(x =>
+      (x.id === parts[i] || norm(x.slug) === want || norm(x.name) === want) &&
+      norm(x.folder) === folderRef);
+    if (p) {
+      const meta = { id: p.id, slug: p.slug || null, name: p.name || null, orgId: p.orgId || null, orgSlug: p.orgSlug || null, folder: p.folder || '' };
+      projectRefCache.set(p.id, meta);
+      return { index: i, meta };
+    }
+  }
+  return null;
+}
+
 /**
  * Resolve a project argument to its meta, accepting the pseudo-filesystem path
  * form (/projects/<name> or /projects/<folder>/<name>) OR a bare slug / name /
@@ -3197,10 +3249,10 @@ server.resource('info', 'drafted://info', {
   };
 });
 
-tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single container and the org is the folder at depth 0: `fs(ls, path="/")` lists the orgs you can address, `/o/<org>` is that org, and every folder level — the org included — carries the SAME four roots:\n\n- `<folder>/wiki/<path>` — knowledge pages (markdown, OKF; free nesting; `index.md` at any level is synthesized and read-only)\n- `<folder>/skills/<slug>` — reusable procedures (flat: one dir per skill slug, `SKILL.md` + supporting files inside; slugs stay unique per ORG, so a skill resolves by slug from anywhere)\n- `<folder>/tasks/<lane?>/<file>` — work items. A task IS a frame: `read` renders its `drafted:status:`/`drafted:assignee:` as front matter and `write`/`edit` parse them back into columns, so they are never stored in the body. The keys are namespaced so an ordinary `status:` in your own front matter is left alone. Valid statuses: open, in_progress, scheduled, needs_review, needs_decision, done, failed (an empty `drafted:status:` clears it). Status is a column, not a location — a task moved out of /tasks stays a task.\n- `<folder>/projects/<project>/<layer>/<lane>/<file>` — producible frames (then exactly layer → lane → file)\n\nFolders nest arbitrarily: `/o/<org>/engineering/backend/wiki/deploy`. The ROOT KEYWORD IS THE SEPARATOR — everything before `wiki`/`skills`/`tasks`/`projects` is the folder chain, everything after is the path inside that root, so `/o/<org>/wiki/engineering/foo` (the org wiki, nested page) and `/o/<org>/engineering/wiki/foo` (the engineering folder\'s wiki) are different pages. The four names are therefore RESERVED: a folder cannot be called one. `fs(ls, path="/o/<org>/<folder>")` shows a folder\'s four roots plus the folders inside it; `fs(mkdir, path="/o/<org>/<folder>")` creates one.\n\n(Bare `/wiki`, `/skills`, `/tasks`, `/projects` roots still resolve via the session\'s working org, at that org\'s root.)\n\nVerbs: `ls` (list a directory), `read` (file content — hashline-annotated for text so `edit` stays surgical), `write` (create/overwrite; extension + layer classify the type: .html design, .md document, .excalidraw diagram, .xlsx/.docx office, images/videos media, .pdf asset, .google-doc/.google-sheet/.google-slide create native Google Workspace files), `edit` (hashline ops for text, element ops for excalidraw, structured ops for office), `mv` (rename/move, cross-project), `rm` (delete), `search` (frames are searched by label AND content, with the matching line returned as a snippet; `fs(search, path="/o/<org>")` fans out across wiki + skills + projects in one call. SEARCH MUST NAME ITS ORG — put it in the path, or pass org=. If you belong to more than one org an unaddressed search is REFUSED rather than silently scoped, because "no matches" from one org is indistinguishable from "nowhere" and you would stop looking. Search several orgs with one call each; every result says which org it came from), `link` / `unlink` / `links` (relate one frame to another frame, to a project, or to an external url — `links` lists a frame\'s edges plus its backlinks, and on a project path lists the tasks linked to that project; a link is stored by ID, so `mv` never breaks it). `mkdir` creates a project only: use `/projects/<project>` or `/projects/<folder>/<project>`, never a layer path. To create a layer, write its first frame at `/projects/<project>/<new-layer>/<lane>/<file>`.\n\nThe project is resolved from the path itself — no separate "open" step. Guardrails are server-side and unchanged: the org in the path must be the project\'s own org (project paths under /o/<org>/ validate it), the G1 wiki-search gate fires before project mutations, attached-skill gates fire on mutations, anchored frames must be read before editing a layer, `.skillinstall/` is stripped on skill push.', {
+tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single container and the org is the folder at depth 0: `fs(ls, path="/")` lists the orgs you can address, `/o/<org>` is that org, and every folder level — the org included — carries the SAME four roots:\n\n- `<folder>/wiki/<path>` — knowledge pages (markdown, OKF; free nesting; `index.md` at any level is synthesized and read-only)\n- `<folder>/skills/<slug>` — reusable procedures (flat: one dir per skill slug, `SKILL.md` + supporting files inside; slugs stay unique per ORG, so a skill resolves by slug from anywhere)\n- `<folder>/tasks/<lane?>/<file>` — work items. A task IS a frame: `read` renders its `drafted:status:`/`drafted:assignee:` as front matter and `write`/`edit` parse them back into columns, so they are never stored in the body. The keys are namespaced so an ordinary `status:` in your own front matter is left alone. Valid statuses: open, in_progress, scheduled, needs_review, needs_decision, done, failed (an empty `drafted:status:` clears it). Status is a column, not a location — a task moved out of /tasks stays a task.\n- `<folder>/projects/<project>/<layer>/<lane>/<file>` — producible frames (then exactly layer → lane → file)\n\nFolders nest arbitrarily: `/o/<org>/engineering/backend/wiki/deploy`. The ROOT KEYWORD IS THE SEPARATOR — everything before `wiki`/`skills`/`tasks`/`projects` is the folder chain, everything after is the path inside that root, so `/o/<org>/wiki/engineering/foo` (the org wiki, nested page) and `/o/<org>/engineering/wiki/foo` (the engineering folder\'s wiki) are different pages. The four names are therefore RESERVED: a folder cannot be called one. `fs(ls, path="/o/<org>/<folder>")` shows a folder\'s four roots plus the folders inside it; `fs(mkdir, path="/o/<org>/<folder>")` creates one.\n\n(Bare `/wiki`, `/skills`, `/tasks`, `/projects` roots still resolve via the session\'s working org, at that org\'s root.)\n\nVerbs: `ls` (list a directory), `read` (file content — hashline-annotated for text so `edit` stays surgical), `write` (create/overwrite; extension + layer classify the type: .html design, .md document, .excalidraw diagram, .xlsx/.docx office, images/videos media, .pdf asset, .google-doc/.google-sheet/.google-slide create native Google Workspace files), `edit` (hashline ops for text, element ops for excalidraw, structured ops for office), `mv` (rename/move — at THREE scopes, same as `rm`: a FILE path moves one frame; a LANE or LAYER path (`/<layer>/<lane>`, `/<layer>`) moves the whole set in one call, in-project or into another project, carrying frame ids, version history, connectors and assets; a PROJECT path (`/o/<org>/projects/<project>`) renames the project, with `to` as the new display name — the slug and every existing URL stay put), `rm` (delete), `search` (frames are searched by label AND content, with the matching line returned as a snippet; `fs(search, path="/o/<org>")` fans out across wiki + skills + projects in one call. SEARCH MUST NAME ITS ORG — put it in the path, or pass org=. If you belong to more than one org an unaddressed search is REFUSED rather than silently scoped, because "no matches" from one org is indistinguishable from "nowhere" and you would stop looking. Search several orgs with one call each; every result says which org it came from), `link` / `unlink` / `links` (relate one frame to another frame, to a project, or to an external url — `links` lists a frame\'s edges plus its backlinks, and on a project path lists the tasks linked to that project; a link is stored by ID, so `mv` never breaks it). `mkdir` creates a project only: use `/projects/<project>` or `/projects/<folder>/<project>`, never a layer path. To create a layer, write its first frame at `/projects/<project>/<new-layer>/<lane>/<file>`.\n\nThe project is resolved from the path itself — no separate "open" step. Guardrails are server-side and unchanged: the org in the path must be the project\'s own org (project paths under /o/<org>/ validate it), the G1 wiki-search gate fires before project mutations, attached-skill gates fire on mutations, anchored frames must be read before editing a layer, `.skillinstall/` is stripped on skill push.', {
   action: z.enum(['ls', 'read', 'write', 'edit', 'mv', 'rm', 'mkdir', 'search', 'link', 'unlink', 'links']).describe('Filesystem verb.'),
   path: z.string().describe('Drafted path: /o/<org>[/<folder…>]/wiki/... | .../skills/... | .../tasks/... | .../projects/... — a folder chain may precede any root (bare /wiki, /skills, /tasks, /projects also work; for mv: source)'),
-  to: z.string().optional().describe('[mv] destination path; [link/unlink] target path — a frame path, or a project path (/o/<org>/projects/<project>) to link a task to a project'),
+  to: z.string().optional().describe('[mv] destination — a frame path for a frame, a container path (/<layer> or /<layer>/<lane>, optionally prefixed /o/<org>/projects/<other-project>/… to move across projects) for a lane or layer, or the NEW NAME when the source path is a project; [link/unlink] target path — a frame path, or a project path (/o/<org>/projects/<project>) to link a task to a project'),
   url: z.string().optional().describe('[link/unlink] external target URL, instead of `to` (a link is internal-by-id OR external-by-url, never both)'),
   query: z.string().optional().describe('[search] term to match against names/content. The path must name an org (/o/<org>) unless you belong to exactly one.'),
   content: z.string().optional().describe('[write] inline HTML/markdown/text'),
@@ -3758,6 +3810,19 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
         }
         rows = kept;
       }
+      // The folder chain was lifted off the path into X-Drafted-Folder — but this
+      // listing is fetched with NO headers and was never filtered by it, so
+      // ls /o/<org>/Marketing/projects answered with every project in the org: a
+      // listing that silently ignores half the address it was given. Scope to
+      // that folder and below, matching the org root, which lists the projects
+      // in its folders too.
+      if (folder) {
+        const want = normalizeFolder(folder);
+        rows = rows.filter(x => {
+          const f = normalizeFolder(x.folder || '');
+          return f === want || f.startsWith(want + '/');
+        });
+      }
       // The bound project is read from THIS session's state, never the shared
       // active-project row (DRAFT-36 concurrency invariant).
       const bound = getState().projectMeta;
@@ -3809,28 +3874,24 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
       }
       return ok(out.join('\n'));
     }
-    if (parts.length >= 4) {
-      projectRef = parts.length === 4 ? parts[0] : parts[1]; // no-folder vs folder form
-      layer = parts[parts.length - 3];
-      lane = parts[parts.length - 2];
-      filename = parts[parts.length - 1];
-    } else if (parts.length === 3) {
-      // /projects/<project>/<layer>/<lane>  OR  /projects/<project>/<layer>/<file>
-      // A lane view (no extension) vs a layer-root file (has an extension) —
-      // mirror the server's dual routes.
-      projectRef = parts[0];
-      const last = parts[2];
-      if (/\.[a-z0-9]+$/i.test(last) && !['designs', 'research', 'plans', 'copy', 'wireframes', 'images', 'components', 'brand-assets'].includes(last)) {
-        layer = parts[1]; lane = null; filename = last; // layer-root file
-      } else {
-        layer = parts[1]; lane = last; filename = null; // lane view
-      }
-    } else if (parts.length === 2) {
-      projectRef = parts[0]; // /projects/<project>/<layer>
-      layer = parts[1]; lane = null; filename = null;
-    } else if (parts.length === 1) {
-      projectRef = parts[0]; // /projects/<project>
+    // Where the FOLDER chain ends and the project begins cannot be decided from
+    // the string: /projects/Marketing/beoflow-marketing (folder + project) and
+    // /projects/some-project/designs (project + layer) are the SAME SHAPE. The
+    // parse used to guess positionally — parts[0], or parts[1] once there were
+    // five segments — so the folder-qualified path fs(ls) ITSELF PRINTS came back
+    // `project not found: Marketing`: a listing whose output is not an address
+    // you can feed back in, which is the one thing a path must always be.
+    // Settle it the way the rest of fs settles ambiguity: by what exists. The
+    // bare form (folder omitted) is tried FIRST, so every path that worked
+    // before still resolves in one lookup and nothing pays for this.
+    projectRef = parts[0];
+    let tail = parts.slice(1);
+    let pathProject = await resolveProjectRef(projectRef).catch(() => null);
+    if (!pathProject?.id && parts.length > 1) {
+      const found = await resolveFolderQualifiedProject(parts);
+      if (found) { projectRef = parts[found.index]; tail = parts.slice(found.index + 1); pathProject = found.meta; }
     }
+    ({ layer, lane, filename } = splitProjectTail(tail));
 
     // fs grammar: the project comes from the PATH, not the shared session
     // binding — scope the whole call to the path's project (request-local, per
@@ -3839,17 +3900,42 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
     // parallel agent can rewrite), so ls/read/write silently touched the wrong
     // project and "fixed itself" when something re-bound — the under-reporting
     // churn reported from the MJ Directive org.
-    if (projectRef) {
-      const pathProject = await resolveProjectRef(projectRef).catch(() => null);
-      if (!pathProject?.id) return err(new Error(`project not found: ${projectRef}`));
-      // An org-scoped path must name a project of that org — never a same-named
-      // project from another org (the path is both address and guardrail).
-      if (orgFromPath && !(await pathOrgMatches(orgFromPath, pathProject))) {
-        return err(new Error(`project ${projectRef} is not in org ${orgFromPath}`));
-      }
-      getState().projectId = pathProject.id;
-      getState().projectMeta = pathProject;
+    if (!pathProject?.id) {
+      // Name the whole path, not parts[0] — "project not found: Marketing" on
+      // /projects/Marketing/beoflow-marketing is the message that sent an agent
+      // hunting for a project called Marketing.
+      return err(new Error(`project not found: ${parts.join('/')} — list projects with fs(ls, path="/o/<org>/projects")`));
+    }
+    // An org-scoped path must name a project of that org — never a same-named
+    // project from another org (the path is both address and guardrail).
+    if (orgFromPath && !(await pathOrgMatches(orgFromPath, pathProject))) {
+      return err(new Error(`project ${projectRef} is not in org ${orgFromPath}`));
     }
+    getState().projectId = pathProject.id;
+    getState().projectMeta = pathProject;
+
+    // The DESTINATION side of the same grammar, folder chain and all. mv and link
+    // share it so the two cannot drift on what an address means — and because the
+    // destination had the mirror of the source bug plus a worse failure mode: a
+    // folder-qualified `to` resolved "Marketing" as the project, found nothing,
+    // and then mv fell through to an IN-PROJECT move to "/site/designs". A
+    // cross-project move that silently stays put is the exact quiet degradation
+    // this codebase keeps paying for, so an unresolvable destination now throws.
+    // Returns null when `to` is a bare in-project path (no /projects prefix).
+    const resolveProjectsDestination = async (raw) => {
+      const clean = String(raw || '').replace(/^\/+|\/+$/g, '');
+      if (!clean.startsWith('projects/') && clean !== 'projects') return null;
+      const segs = clean.replace(/^projects\/?/, '').split('/').filter(Boolean);
+      if (!segs.length) throw new Error('destination needs a project: /o/<org>/projects/<project>/...');
+      let idx = 0;
+      let meta = await resolveProjectRef(segs[0]).catch(() => null);
+      if (!meta?.id && segs.length > 1) {
+        const found = await resolveFolderQualifiedProject(segs);
+        if (found) { idx = found.index; meta = found.meta; }
+      }
+      if (!meta?.id) throw new Error(`destination project not found: ${segs.join('/')} — list projects with fs(ls, path="/o/<org>/projects")`);
+      return { meta, rest: segs.slice(idx + 1) };
+    };
 
     const run = async () => {
       const hasFile = layer && filename;
@@ -3865,15 +3951,13 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
 
       switch (action) {
         case 'ls': {
-          // Listing path relative to the project. No-folder forms: [p] → '/',
-          // [p, layer] → '/layer', [p, layer, lane] → '/layer/lane' — a lane/layer
+          // Listing path relative to the project — everything after the project
+          // segment, whatever the folder chain in front of it was. A lane/layer
           // URL IS this path (Q2), so ls of a shared lane URL lists the lane.
-          // (Folder-form ls — [folder, p, layer[, lane]] — is a pre-existing dead
-          // end: the parse takes parts[0] as the project ref and resolve fails.)
-          let lsPath, lsProjectId;
-          if (projectRef && parts.length >= 3) { lsProjectId = projectRef; lsPath = '/' + parts.slice(parts.length - 2).join('/'); }
-          else if (projectRef && parts.length === 2) { lsProjectId = projectRef; lsPath = '/' + parts[1]; }
-          else { lsProjectId = projectRef; lsPath = '/'; }
+          // (Taken from `tail`, not sliced off `parts` by position: with a folder
+          // in the path the positional slice took the wrong two segments, which
+          // is the other half of why folder-form ls was a dead end.)
+          const lsPath = tail.length ? '/' + tail.join('/') : '/';
           const lsParams = new URLSearchParams({ path: lsPath });
           if (recursive) { lsParams.set('recursive', 'true'); lsParams.set('summary', 'true'); }
           if (pattern) lsParams.set('pattern', pattern);
@@ -3964,25 +4048,53 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
           return ok(result);
         }
         case 'mv': {
-          const from = lane ? `/${layer}/${lane}/${filename}` : `/${layer}/${filename}`;
-          const toClean = (to || '').replace(/^\/+|\/+$/g, '');
-          const toHasProject = toClean.startsWith('projects/');
-          const toParts = toClean.replace(/^projects\/?/, '').split('/').filter(Boolean);
+          // Same three scopes as rm — a file, a container (lane or layer), or the
+          // project itself. mv used to assume a FILE at every scope: a lane path
+          // built `/screens/main/null` and 404'd, and a project path built
+          // `/null/null`, so "rename a project" and "move a lane" both read as
+          // capabilities Drafted does not have. It has both; only this seam was
+          // missing. (moveFrames has carried units 'lane' and 'layer', with
+          // connectors and assets, since cross-project move shipped.)
+          const scope = rmScope(layer, lane, filename);
+          if (scope === 'project') {
+            const pid = getState().projectId;
+            if (!pid) return err(new Error('could not resolve project id for rename'));
+            // `to` may be a bare new name or a full destination path — the last
+            // segment is the name either way.
+            const newName = String(to || '').replace(/^\/+|\/+$/g, '').split('/').filter(Boolean).pop();
+            if (!newName) return err(new Error('mv on a project path renames it — pass the new name, e.g. to="Onboarding — source of truth"'));
+            const renamed = await api('PATCH', `/api/project/${pid}`, { name: newName }, orgHeader);
+            const meta = getState().projectMeta || {};
+            return ok({
+              renamed: true, projectId: pid, name: renamed?.name || newName, slug: meta.slug,
+              path: `/o/${meta.orgSlug || orgFromPath || ''}/projects/${[meta.folder, meta.slug || pid].filter(Boolean).join('/')}`,
+              // Say this before the agent hands a human a URL it inferred from the
+              // new name. Renaming is a DISPLAY-name change, exactly as in the web
+              // UI: the slug is left alone so every link already shared keeps working.
+              slugNote: 'Slug and URLs are UNCHANGED — rename sets the display name only, so links already shared keep working. Keep addressing the project by the slug above.',
+            });
+          }
+          // Container source: a lane (/{layer}/{lane}) or a whole layer
+          // (/{layer}). The destination is a container path in the same grammar.
+          const from = scope === 'directory'
+            ? `/${layer}${lane ? '/' + lane : ''}`
+            : (lane ? `/${layer}/${lane}/${filename}` : `/${layer}/${filename}`);
+          let dest;
+          try { dest = await resolveProjectsDestination(to); }
+          catch (e) { return err(e); }
           let toPath, toProjectId;
-          if (toHasProject && toParts.length >= 2) {
-            // Full destination path: first segment after /projects is the project ref
-            // (fs grammar: /projects/<project>/<layer>[/<lane>]/<file>). Drop it from
-            // the path; resolve toProjectId only when it differs from the source.
-            const toRef = toParts[0];
-            const sameProject = projectRef && String(toRef).toLowerCase() === String(projectRef).toLowerCase();
-            if (!sameProject) {
-              const toMeta = await resolveProjectRef(toRef).catch(() => null);
-              if (toMeta) toProjectId = toMeta.id;
+          if (dest) {
+            if (!dest.rest.length) {
+              return err(new Error('mv needs a destination layer: /o/<org>/projects/<project>/<layer>[/<lane>][/<file>]'));
             }
-            toPath = '/' + toParts.slice(1).join('/');
+            // Compare RESOLVED ids, not the strings: the same project addressed
+            // two ways (slug here, folder-qualified path there) is one project.
+            if (dest.meta.id !== getState().projectId) toProjectId = dest.meta.id;
+            toPath = '/' + dest.rest.join('/');
           } else {
             // Bare relative path (no project prefix): /{layer}[/{lane}]/{file}
-            toPath = toParts.length ? '/' + toParts.join('/') : (to || '');
+            const segs = String(to || '').replace(/^\/+|\/+$/g, '').split('/').filter(Boolean);
+            toPath = segs.length ? '/' + segs.join('/') : String(to || '');
           }
           const result = await api('POST', '/api/fs/mv', { from, to: toPath, ...(toProjectId ? { toProjectId } : {}) }, orgHeader);
           return ok(result);
@@ -4022,28 +4134,24 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
           if (args.url) {
             body.url = args.url;
           } else if (to) {
-            // Same destination grammar as mv: /projects/<ref>/<layer>/... is a
-            // frame in another project, /projects/<ref> alone is the project
-            // itself (the "this task belongs to that project" edge), and a bare
-            // /<layer>/... is a frame in this one.
-            const toClean = String(to).replace(/^\/+|\/+$/g, '');
-            const toParts = toClean.replace(/^projects\/?/, '').split('/').filter(Boolean);
-            if (toClean.startsWith('projects/') && toParts.length === 1) {
-              const toMeta = await resolveProjectRef(toParts[0]).catch(() => null);
-              if (!toMeta?.id) return err(new Error(`project not found: ${toParts[0]}`));
+            // Same destination grammar as mv, through the SAME resolver: a
+            // /projects/<...>/<layer>/... path is a frame in another project,
+            // /projects/<...> alone is the project itself (the "this task belongs
+            // to that project" edge), and a bare /<layer>/... is a frame in this
+            // one. Sharing the resolver is the point — a link and a move that
+            // disagreed about which project a path names would be silent.
+            let dest;
+            try { dest = await resolveProjectsDestination(to); }
+            catch (e) { return err(e); }
+            if (dest && !dest.rest.length) {
               body.toType = 'project';
-              body.toId = toMeta.id;
-            } else if (toClean.startsWith('projects/') && toParts.length >= 2) {
-              const toRef = toParts[0];
-              const sameProject = projectRef && String(toRef).toLowerCase() === String(projectRef).toLowerCase();
-              if (!sameProject) {
-                const toMeta = await resolveProjectRef(toRef).catch(() => null);
-                if (!toMeta?.id) return err(new Error(`project not found: ${toRef}`));
-                body.toProjectId = toMeta.id;
-              }
-              body.to = '/' + toParts.slice(1).join('/');
+              body.toId = dest.meta.id;
+            } else if (dest) {
+              if (dest.meta.id !== getState().projectId) body.toProjectId = dest.meta.id;
+              body.to = '/' + dest.rest.join('/');
             } else {
-              body.to = toParts.length ? '/' + toParts.join('/') : String(to);
+              const segs = String(to).replace(/^\/+|\/+$/g, '').split('/').filter(Boolean);
+              body.to = segs.length ? '/' + segs.join('/') : String(to);
             }
           } else {
             return err(new Error(`${action} needs a target: to="<frame or project path>" or url="https://..."`));

package/mcp/test-org-guards.mjs

@@ -5,7 +5,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
-import { projectlessMutationNeedsOrg, boundOrgRejected, receiptOrg, splitOrgScope, stripUrlOrigin, rmScope } from './server.mjs';
+import { projectlessMutationNeedsOrg, boundOrgRejected, receiptOrg, splitOrgScope, stripUrlOrigin, rmScope, splitProjectTail } from './server.mjs';
 import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';
 
 // One rule governs create AND fork (a fork is a create). A write proceeds when its
@@ -178,6 +178,30 @@ assert.equal(rmScope('slides', 'deck', null), 'directory', 'a LANE path must nev
 assert.equal(rmScope('slides', null, null), 'directory', 'a LAYER path must never archive the project');
 assert.equal(rmScope(null, null, null), 'project', 'only the bare project path archives the project');
 
+// fs(mv) reads the SAME three scopes, which is why they share one predicate: a
+// file path moves one frame, a lane/layer path moves the whole set, and a bare
+// project path renames the project. mv used to assume 'file' at every scope and
+// built "/slides/deck/null" for a lane — a 404 that read as "lanes cannot move".
+assert.equal(rmScope('slides', 'deck', null), 'directory', 'mv on a LANE path moves the lane, not a frame called null');
+assert.equal(rmScope('slides', null, null), 'directory', 'mv on a LAYER path moves the layer');
+assert.equal(rmScope(null, null, null), 'project', 'mv on a bare project path renames the project');
+
+// splitProjectTail: everything AFTER the project segment. It reads the tail only,
+// so the folder chain in front of the project cannot shift the layer/lane/file
+// the way the old positional `parts.length ===` branches did — that is what made
+// /projects/Marketing/beoflow-marketing answer "project not found: Marketing".
+{
+  const t = (tail, expected, why) => assert.deepEqual(splitProjectTail(tail), expected, why);
+  t([], { layer: undefined, lane: null, filename: null }, 'no tail = the project itself');
+  t(['designs'], { layer: 'designs', lane: null, filename: null }, 'one segment = a layer');
+  t(['designs', 'default'], { layer: 'designs', lane: 'default', filename: null }, 'no extension = a lane');
+  t(['designs', 'a.html'], { layer: 'designs', lane: null, filename: 'a.html' }, 'an extension = a layer-root file');
+  t(['designs', 'default', 'a.html'], { layer: 'designs', lane: 'default', filename: 'a.html' }, 'the full frame path');
+  // A lane may legitimately be named after a layer; treating it as a file here
+  // would send the read to /designs/designs and 404 on a lane that exists.
+  t(['plans', 'designs'], { layer: 'plans', lane: 'designs', filename: null }, 'a layer NAME as the last segment is still a lane');
+}
+
 console.log('org-guard policy OK');
 // Importing server.mjs builds the stdio MCP singleton, which opens a WS reconnect
 // loop that keeps the event loop alive. Assertions are done — exit deterministically.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.35",
+  "version": "1.19.36",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [