drafted 1.19.52 → 1.19.54

package/mcp/server.mjs

@@ -174,7 +174,7 @@ export function textFromLocalFile(filePath) {
 // validation, and every handler stay byte-for-byte unchanged.
 const REMOTE_JSON_STRING_PARAMS = {
   fs: ['ops', 'state'],
-  minion: ['target', 'checklist', 'output'],
+  minion: ['target', 'checklist', 'output', 'context'],
   trigger: ['payload'],
 };
 
@@ -466,7 +466,7 @@ const TOOL_ANNOTATIONS = {
   screenshot:          { title: 'Screenshot',          readOnlyHint: true,  destructiveHint: false, openWorldHint: false, description: 'Render a PNG via headless browser. `scope=frame` for a single frame, `scope=canvas` for a region of the project surface.' },
 
   // Minions — checklist-driven intake surfaces bound to a project
-  minion:              { title: 'Minions',             readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Manage Minions: checklist-driven intake surfaces that guide a consumer through a checklist (via a shareable /c/<slug>-<token> link) and write a producible into the project. Dispatch by `action`: meta, list, get, create, update, enable, disable, delete. QA your own Minions with test_start/test_say/test_resolve — drive the checklist conversation yourself (works even when disabled). Requires the agent allowlist.' },
+  minion:              { title: 'Minions',             readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Manage Minions: Drafted\'s agent for people OUTSIDE the org (bidders, clients, suppliers). A visitor opens a shareable /c/<slug>-<token> link, the Minion guides them through a checklist, writes ONE submission record into the project, and on submit marks it needs_review and queues it on output.handoff (a queue trigger) for YOUR agent to claim with trigger pending/claim/complete. A Minion never sends, shares or contacts anyone — outbound follow-up is your job. Everything in a Minion\'s config and its context pack is visible to anyone holding the link. Dispatch by `action`: meta, list, get, create, update, enable, disable, delete. QA your own Minions with test_start/test_say (works even when disabled). Requires the agent allowlist.' },
   trigger:             { title: 'Inbound triggers',    readOnlyHint: false, destructiveHint: true,  openWorldHint: true,  description: 'Manage inbound webhook triggers for the ACTIVE PROJECT: an external system (AppSheet bot, GitHub, form tool) POSTs to the trigger URL and the server runs an agent conversation in the project from the stored prompt template + payload. Dispatch by `action`: create (returns URL + secret token ONCE — relay it to the user immediately, not retrievable later), list, update (enable/disable, edit template, daily limit, executor), rotate (new token), test (fire a synthetic delivery), deliveries (audit log), delete; for executor="queue" triggers, pending/claim/complete let a LOCAL agent poll and work queued deliveries. Requires the agent allowlist.' },
   fs:                  { title: 'Filesystem',           readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Navigate Drafted like a local filesystem: /wiki/<path> pages, /skills/<slug> procedures, /projects/<folder?>/<project>/<layer>/<lane>/<file> frames. Verbs: ls, read, write, edit, mv, rm, search, link, unlink, links.' },
   // Google Drive mirror triage. Mutating (resolve/retry_all/sync rewrite frame
@@ -479,7 +479,7 @@ function isMutatingToolCall(name, args = {}) {
   const action = args?.action;
   switch (name) {
     case 'minion':
-      return ['create', 'update', 'enable', 'disable', 'delete', 'test_start', 'test_say', 'test_resolve'].includes(action);
+      return ['create', 'update', 'enable', 'disable', 'delete', 'test_start', 'test_say'].includes(action);
     case 'trigger':
       return ['create', 'update', 'rotate', 'delete'].includes(action);
     case 'fs':
@@ -2878,8 +2878,8 @@ tool('tour', {
 // re-pointed at content the human never read. See SECURITY.md.
 tool('action', {
   action: z.enum(['propose', 'list', 'read']).describe('propose: ask a human to authorise one outward effect, or a chain of them approved together. list: your org\'s pending proposals. read: one chain with every payload as the approver will see it.'),
-  type: z.string().optional().describe('[propose] One of: share_project, share_frame, change_share_role, create_public_frame_link, create_public_lane_link, comment_mention. Anything else is refused — the list is fixed in source, not data.'),
-  payload: z.string().optional().describe('[propose] JSON object for this type. share_project {projectId,email,role}; share_frame {frameId,email,role}; change_share_role {shareId,role}; create_public_frame_link {frameId}; create_public_lane_link {projectId,layer,lane}; comment_mention {frameId,body,email}. Optional expiresInHours on the share types.'),
+  type: z.string().optional().describe('[propose] One of: share_project, share_frame, change_share_role, create_public_frame_link, create_public_lane_link, comment_mention, send_email. Anything else is refused — the list is fixed in source, not data.'),
+  payload: z.string().optional().describe('[propose] JSON object for this type. share_project {projectId,email,role}; share_frame {frameId,email,role}; change_share_role {shareId,role}; create_public_frame_link {frameId}; create_public_lane_link {projectId,layer,lane}; comment_mention {frameId,body,email}; send_email {from,to,subject,body} (plain text, sent AS you from your own Gmail connected in this workspace; `from` is that address; only you can approve it). Optional expiresInHours on the share types.'),
   actions: z.string().optional().describe('[propose] JSON array of {type,payload} to approve TOGETHER as one chain — e.g. share with three people, then comment tagging them. One screen, one decision. Execution is sequential and stops at the first failure; a sent email cannot be rolled back, so it is never all-or-nothing.'),
   groupId: z.string().optional().describe('[read] The chain to read.'),
   reason: z.string().optional().describe('[propose] One line telling the approver WHY. They see it next to what the action does.'),
@@ -3152,12 +3152,10 @@ function ensureSkillInstallIgnored(dir) {
 
 
 tool('minion', {
-  action: z.enum(['meta', 'list', 'get', 'create', 'update', 'enable', 'disable', 'delete', 'test_start', 'test_say', 'test_resolve']).describe('Operation to perform. test_* drive a QA conversation against a Minion you own (even disabled) to verify it end-to-end.'),
+  action: z.enum(['meta', 'list', 'get', 'create', 'update', 'enable', 'disable', 'delete', 'test_start', 'test_say']).describe('Operation to perform. test_* drive a QA conversation against a Minion you own (even disabled) to verify it end-to-end.'),
   id: z.string().optional().describe('[get|update|enable|disable|delete|test_*] Minion ID (UUID)'),
   text: z.string().optional().describe('[test_say] the consumer message to send to your test run'),
   fresh: z.boolean().optional().describe('[test_start] start a brand-new run instead of resuming your latest'),
-  actionId: z.string().optional().describe('[test_resolve] id of the pending action to resolve'),
-  approve: z.boolean().optional().describe('[test_resolve] approve (default true) or reject the pending action'),
   projectId: z.string().optional().describe('[meta|list|create] the project this Minion belongs to — REQUIRED, as a path (/projects/<name> or /projects/<folder>/<name>), slug, or UUID. Minions are project-scoped: they write producibles into that project\'s surface. No session fallback — name the project.'),
   name: z.string().optional().describe('[create|update] Minion name'),
   description: z.string().optional().describe('[create|update] one-line description shown to the consumer'),
@@ -3186,8 +3184,15 @@ tool('minion', {
       sheet: z.string().describe('existing Google Sheet frame path or id to append rows to'),
       tab: z.string().optional().describe('sheet tab/range name to append to, e.g. "Erfassung" (defaults to Sheet1)'),
       columns: z.array(z.string()).optional().describe('columns in order; a link to the produced record is included'),
-    }).optional().describe('also append one row per submission to an existing sheet, linking the produced record'),
+    }).optional().describe('one row per submission in an existing sheet. With a handoff the row travels in the handoff payload for your agent to append; without one the Minion appends it (raw values, no read access)'),
+    handoff: z.object({
+      triggerId: z.string().describe('a trigger with executor "queue" in the SAME project'),
+    }).optional().describe('where a submitted record is queued for your connected agent to claim (trigger pending/claim/complete); the payload is marked trust:"untrusted-external"'),
   }).optional().describe('[create|update] where/how the producible lands'),
+  context: z.object({
+    frames: z.array(z.string()).describe('frame ids in the SAME project, max 20'),
+  }).optional().describe('[create|update] the brief pack the Minion may read and answer from (read_brief). DISCLOSED to every visitor — include only what they may see. The Minion cannot read anything else in the org.'),
+  visitorDailyLimit: z.number().optional().describe('[create|update] turns per visitor per UTC day (default 30); dailyLimit is shared by all visitors'),
   limit: z.number().optional().describe('[list] max results per page (default 25, max 100)'),
   offset: z.number().optional().describe('[list] skip N results for pagination (default 0)'),
   compact: z.boolean().optional().describe('[list] return only {id,slug,name,enabled,projectId} per Minion'),
@@ -3216,20 +3221,22 @@ tool('minion', {
       }
       case 'create': {
         // projectId lives in the BODY (the POST route reads body, ignores the query).
-        const { name, description, target, checklist, output, enabled } = args;
+        const { name, description, target, checklist, output, enabled, context, visitorDailyLimit } = args;
         if (!name || !target || !Array.isArray(checklist) || !output) {
           throw new Error('name, target, checklist[], and output are required for action=create');
         }
         const body = { projectId: project.id, name, target, checklist, output };
         if (description !== undefined) body.description = description;
         if (enabled !== undefined) body.enabled = enabled;
+        if (context !== undefined) body.context = context;
+        if (visitorDailyLimit !== undefined) body.visitorDailyLimit = visitorDailyLimit;
         const created = await scoped(() => api('POST', '/api/minions', body));
         return ok({ ...created, projectPath });
       }
       case 'update': {
         if (!args.id) throw new Error('id is required for action=update');
         const body = {};
-        for (const k of ['name', 'description', 'target', 'checklist', 'output', 'enabled']) {
+        for (const k of ['name', 'description', 'target', 'checklist', 'output', 'enabled', 'context', 'visitorDailyLimit']) {
           if (args[k] !== undefined) body[k] = args[k];
         }
         if (Object.keys(body).length === 0) throw new Error('At least one field is required for action=update');
@@ -3253,11 +3260,6 @@ tool('minion', {
         if (!args.text) throw new Error('text is required for action=test_say');
         return ok(await api('POST', `/api/minions/${args.id}/test-message`, { content: args.text }));
       }
-      case 'test_resolve': {
-        if (!args.id) throw new Error('id is required for action=test_resolve');
-        if (!args.actionId) throw new Error('actionId is required for action=test_resolve');
-        return ok(await api('POST', `/api/minions/${args.id}/test-resolve`, { actionId: args.actionId, approve: args.approve !== false }));
-      }
       default:
         throw new Error(`Unknown minion action: ${action}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.52",
+  "version": "1.19.54",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [
@@ -63,19 +63,29 @@
     "lucide": "^1.16.0",
     "mdast-util-from-markdown": "^2.0.3",
     "multer": "^2.1.1",
-    "nodemailer": "^8.0.2",
+    "nodemailer": "^10.0.13",
     "parse5": "^8.0.1",
     "pg": "^8.20.0",
     "playwright": "^1.58.2",
-    "puppeteer": "^24.37.5",
+    "puppeteer": "^25.12.0",
     "qrcode-terminal": "^0.12.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.5",
     "ws": "^8.21.3",
     "yaml": "^2.8.3",
     "zod": "^4.3.6"
   },
+  "overrides": {
+    "@excalidraw/excalidraw": {
+      "nanoid": "^3.3.19"
+    },
+    "@excalidraw/mermaid-to-excalidraw": {
+      "nanoid": "^5.1.16"
+    },
+    "immutable": "^4.3.9",
+    "lodash-es": "^4.18.1"
+  },
   "keywords": [
     "design",
     "canvas",