drafted 1.19.6 → 1.19.8

package/mcp/server.mjs

@@ -384,11 +384,11 @@ const TOOL_ANNOTATIONS = {
   auth:                { title: 'Sign in',             readOnlyHint: false, destructiveHint: false, openWorldHint: true,  description: 'Sign in to Drafted. `action=get_link` returns a URL immediately and starts background approval polling; after the user opens the link, later Drafted tool calls also auto-consume the approved login. `action=login` opens a browser when needed and explicitly waits/polls for approval.' },
 
   // Identity — read-only introspection of THIS agent's session
-  whoami:              { title: 'Session identity',    readOnlyHint: true,  destructiveHint: false, openWorldHint: false, description: 'Return THIS agent session\'s identity: its server-assigned human-readable name (the correlation key between an agent window and its web-app session tab), sessionId, userId, orgId, active projectId, editor label, server URL, and surfaced/alive state — PLUS server health, the installed MCP version/update status (cached ~5min), and `googleDrive` — whether the working org has Google Drive connected: when `googleDrive.connected` is true, strongly prefer Google Workspace frames (.google-doc/.google-sheet/.google-slide) for docs, sheets, and decks; when false they cannot be created at all. Call once per session, right after starting, so a required update surfaces before you act on stale tool behavior. Read-only. Use this — not guesses from the host environment — to report which session you are.' },
+  whoami:              { title: 'Session identity',    readOnlyHint: true,  destructiveHint: false, openWorldHint: false, description: 'Return THIS agent session\'s identity: its server-assigned human-readable name (the correlation key between an agent window and its web-app session tab), sessionId, userId, orgId, active projectId, editor label, server URL, and surfaced/alive state (`authState` says whether this session is signed in, and `authNote` names the exact call that fixes it when it is not — never diagnose a null userId yourself) — PLUS server health, the installed MCP version/update status (cached ~5min), and `googleDrive` — whether the working org has Google Drive connected: when `googleDrive.connected` is true, strongly prefer Google Workspace frames (.google-doc/.google-sheet/.google-slide) for docs, sheets, and decks; when false they cannot be created at all. Call once per session, right after starting, so a required update surfaces before you act on stale tool behavior. Read-only. Use this — not guesses from the host environment — to report which session you are.' },
 
   // Session naming — the name-before-work gate: every agent session must set a short
   // name describing the work before any other tool call succeeds.
-  session:             { title: 'Session',              readOnlyHint: false, destructiveHint: false, openWorldHint: false, description: 'Name THIS agent session (and rename it later). The name is what the user sees on your surface tab — pick a short 2-3 word description of the work (e.g. "beoflow backend", "drafted fs work"). The name persists across reconnects and restarts; you only set it once unless the work changes. Dispatch by `action`: `name` (set/rename with the `name` param).' },
+  session:             { title: 'Session',              readOnlyHint: false, destructiveHint: false, openWorldHint: false, description: 'Name THIS agent session (and rename it later). The name is what the user sees on your surface tab — pick a short 2-3 word description of the work (e.g. "beoflow backend", "drafted fs work"). The name persists across reconnects and restarts; you only set it once unless the work changes. Dispatch by `action`: `name` (set/rename with the `name` param) or `update` (update the npm-installed Drafted MCP on THIS machine when whoami reports mcpUpdate.stale — run it yourself rather than handing the user a shell command; `dryRun` reports without starting it).' },
 
   // Comments — the review loop agents could previously only reach over raw HTTP
   comment:             { title: 'Comments',              readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Read and write review comments on frames. Comments are notes ABOUT THE WORK: they attach to a frame, optionally to one element inside it, and anyone who can see the frame sees them. Dispatch by `action`: list (paginated, compact mode), add (with an optional element anchor or a reply), resolve, reopen, delete. Use this to leave findings a human can action in place, and to read the feedback they left you.' },
@@ -401,7 +401,7 @@ const TOOL_ANNOTATIONS = {
   // Minions — checklist-driven intake surfaces bound to a project
   minion:              { title: 'Minions',             readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Manage Minions: checklist-driven intake surfaces that guide a consumer through a checklist (via a shareable /c/<slug> link) and write a producible into the project. Dispatch by `action`: meta, list, get, create, update, enable, disable, delete. QA your own Minions with test_start/test_say/test_resolve — drive the checklist conversation yourself (works even when disabled). Requires the agent allowlist.' },
   trigger:             { title: 'Inbound triggers',    readOnlyHint: false, destructiveHint: true,  openWorldHint: true,  description: 'Manage inbound webhook triggers for the ACTIVE PROJECT: an external system (AppSheet bot, GitHub, form tool) POSTs to the trigger URL and the server runs an agent conversation in the project from the stored prompt template + payload. Dispatch by `action`: create (returns URL + secret token ONCE — relay it to the user immediately, not retrievable later), list, update (enable/disable, edit template, daily limit, executor), rotate (new token), test (fire a synthetic delivery), deliveries (audit log), delete; for executor="queue" triggers, pending/claim/complete let a LOCAL agent poll and work queued deliveries. Requires the agent allowlist.' },
-  fs:                  { title: 'Filesystem',           readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Navigate Drafted like a local filesystem: /wiki/<path> pages, /skills/<slug> procedures, /projects/<folder?>/<project>/<layer>/<lane>/<file> frames. Verbs: ls, read, write, edit, mv, rm, search.' },
+  fs:                  { title: 'Filesystem',           readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Navigate Drafted like a local filesystem: /wiki/<path> pages, /skills/<slug> procedures, /projects/<folder?>/<project>/<layer>/<lane>/<file> frames. Verbs: ls, read, write, edit, mv, rm, search, link, unlink, links.' },
   repo:                { title: 'Git repos',           readOnlyHint: false, destructiveHint: true,  openWorldHint: true,  description: 'Registered git repos — the org index of .agents/ skills + identities. A connected repo is the source of truth for its skills; EVERY repo connected to ANY folder in the org is searchable and usable org-wide (no org-level repo — the union is the library). Skills from connected repos are readable via fs(read, path="/skills/<slug>") — fetched from git at read time, always fresh. Authoring a Drafted skill whose slug collides with a repo-indexed skill returns 409 repo_owned pointing at the repo. Dispatch by `action`: list (paginated, compact mode), add (link a repo to a folder, --branch optional), rescan (re-fetch the tracked branch), entries (search the index). Content stays in git; Drafted keeps a read-only index.' },
 };
 
@@ -413,7 +413,7 @@ function isMutatingToolCall(name, args = {}) {
     case 'trigger':
       return ['create', 'update', 'rotate', 'delete'].includes(action);
     case 'fs':
-      return !['ls', 'read', 'search'].includes(action);
+      return !['ls', 'read', 'search', 'links'].includes(action);
     default:
       return false;
   }
@@ -2204,6 +2204,8 @@ async function sessionSurfaceBlock() {
   if (agentSurface) {
     return {
       sessionId,
+      authenticated: !!agentSurface.userId,
+      authState: agentSurface.userId ? 'authenticated' : 'signed_out',
       userId: agentSurface.userId ?? null,
       orgId: agentSurface.orgId ?? null,
       projectId: agentSurface.projectId ?? null,
@@ -2232,6 +2234,7 @@ async function sessionSurfaceBlock() {
     try {
       const res = await serverFetch(`${getServerUrl()}/auth/me`, { headers: { Cookie: `gc_session=${cookieSid}` } });
       if (res.ok) me = await res.json();
+      // else: the server ANSWERED and rejected this session — a real sign-out, not a blip.
     } catch (e) {
       // Transport failure, NOT a sign-out. Conflating the two made agents tell
       // users "you're signed out" during a network blip and start needless
@@ -2242,8 +2245,26 @@ async function sessionSurfaceBlock() {
     }
   }
   const nameRequired = !!me?.agentClone && !me?.surfaceName;
+  // A null userId used to come back BARE — no reason, no next step — and agents filled the
+  // gap by inventing one: a real report has an agent telling the user to look for a pending
+  // "device/session approval prompt" in the desktop app (no such prompt exists) and then
+  // waiting on it. Name which of the four states this is and the exact call that ends it.
+  const pending = (!me && !unreachable) ? getPendingDeviceCode() : null;
+  const authState = me?.userId ? 'authenticated'
+    : unreachable ? 'server_unreachable'
+    : pending ? 'awaiting_approval'
+    : cookieSid ? 'session_rejected'
+    : 'signed_out';
+  const AUTH_NOTES = {
+    awaiting_approval: `Sign-in started but NOT yet approved. Give the user this link and ask them to open it: ${pending?.verificationUrl || '(run auth(action="get_link") for a fresh link)'} — this session authenticates itself once they approve; nothing to approve inside the desktop app.`,
+    session_rejected: 'Not signed in: this machine has a stored Drafted session but the server rejected it (expired or revoked). Call auth(action="get_link") and give the user the returned URL. Do NOT ask them to look for an approval prompt in the desktop app — being signed in to the app does not sign THIS agent in.',
+    signed_out: 'Not signed in: no Drafted session on this machine. Call auth(action="get_link") and give the user the returned URL. Do NOT ask them to look for an approval prompt in the desktop app — being signed in to the app does not sign THIS agent in.',
+  };
   return {
     sessionId: cookieSid,
+    authenticated: !!me?.userId,
+    authState,
+    ...(AUTH_NOTES[authState] ? { authNote: AUTH_NOTES[authState] } : {}),
     userId: me?.userId ?? null,
     orgId: me?.currentOrg?.id ?? null,
     projectId: getState().projectId ?? null,
@@ -2254,6 +2275,9 @@ async function sessionSurfaceBlock() {
     color: null,
     surfaced: false,
     alive: false,
+    // `alive` is bare here where it isn't in the acked branch, and a bare false reads as
+    // "something is broken" — it only means the surface WebSocket hasn't acked yet.
+    aliveMeaning: 'The surface WebSocket has not acked this session yet, so no canvas is known to be open. Frame, wiki, and skill writes all persist normally — only focus/presence have nothing to draw on. Do not change what you write because of this, and do not report it as an error.',
     ...(unreachable ? {
       serverUnreachable: true,
       note: unreachableWhy || `Could not reach ${getServerUrl()} — identity UNKNOWN, not signed out. This is a network/transport failure: do not tell the user they are logged out and do not start a new login; retry when connectivity is back.`,
@@ -2285,7 +2309,7 @@ async function getGoogleDriveAvailability() {
 // reachability, and installed-MCP staleness in ONE bootstrap call. The update data is
 // cached (5min), so repeat `whoami` calls are free; the server-side update gate still
 // blocks mutating calls on its own, independent of this tool. Read-only — no state changed.
-tool('whoami', 'Return THIS agent session\'s identity: its server-assigned human-readable name (the correlation key between an agent window and its web-app session tab), sessionId, userId, orgId, active projectId, editor label, server URL, and surfaced/alive state — PLUS server health, the installed MCP version/update status (cached ~5min), and `googleDrive` — whether the working org has Google Drive connected: when `googleDrive.connected` is true, strongly prefer Google Workspace frames (.google-doc/.google-sheet/.google-slide) for docs, sheets, and decks; when false they cannot be created at all. Call once per session, right after starting, so a required update surfaces before you act on stale tool behavior. Read-only.', {}, async () => {
+tool('whoami', 'Return THIS agent session\'s identity: its server-assigned human-readable name (the correlation key between an agent window and its web-app session tab), sessionId, userId, orgId, active projectId, editor label, server URL, and surfaced/alive state (`authState` says whether this session is signed in, and `authNote` names the exact call that fixes it when it is not — never diagnose a null userId yourself) — PLUS server health, the installed MCP version/update status (cached ~5min), and `googleDrive` — whether the working org has Google Drive connected: when `googleDrive.connected` is true, strongly prefer Google Workspace frames (.google-doc/.google-sheet/.google-slide) for docs, sheets, and decks; when false they cannot be created at all. Call once per session, right after starting, so a required update surfaces before you act on stale tool behavior. Read-only.', {}, async () => {
   try {
     // Ensure the child clone exists BEFORE reading identity — otherwise the /auth/me
     // fallback (pre-WS-ack) queries the ROOT session and reports the wrong naming state.
@@ -2295,7 +2319,19 @@ tool('whoami', 'Return THIS agent session\'s identity: its server-assigned human
     // Tell the agent to actually surface its name to the user — returning `name` in the JSON isn't
     // enough; without an explicit instruction agents rarely say which session they are, so users
     // can't match them to their tab on the Drafted surface.
-    const instruction = block.nameRequired
+    // Auth outranks naming: an unauthenticated session has nothing to name, and leaving the
+    // instruction empty is what let agents invent their own explanation for the null ids.
+    // A stale install can now fix ITSELF — say so here, since this is where staleness is
+    // reported and an agent that only reads `stale: true` goes back to the user with a shell
+    // command they didn't ask for.
+    const staleNote = mcpUpdate.stale && mcpUpdate.mode === 'stdio'
+      ? ` This machine's installed Drafted MCP is out of date (${mcpUpdate.currentVersion} → ${mcpUpdate.latestVersion || 'latest'})${mcpUpdate.required ? ' and BELOW the minimum required version, so mutating tools are blocked' : ''}. Call session(action="update") to update it yourself — do not hand the user a shell command.`
+      : '';
+    const instruction = block.authNote
+      ? block.authNote + staleNote
+      : staleNote && !block.nameRequired
+      ? (block.name ? `You are the session named "${block.name}". Tell the user you're "${block.name}" in your reply so they can match you to your tab on the Drafted surface.` : '') + staleNote
+      : block.nameRequired
       ? `You have NO session name yet — the name-before-work gate blocks all other tools until you set one. Name this session by the work you're doing with the user: a short 2-3 word description (suggested: "${block.suggestedName || '...'}"). Set it now with session(action="name", name="<your name>"), then tell the user you're "<name>".`
       : block.name
         ? `You are the session named "${block.name}". Tell the user you're "${block.name}" in your reply so they can match you to your tab on the Drafted surface.`
@@ -2314,13 +2350,69 @@ tool('whoami', 'Return THIS agent session\'s identity: its server-assigned human
   } catch (error) { return err(error); }
 });
 
+// Self-update: run the installed CLI's own updater so THIS machine's stale stdio MCP can be
+// refreshed from inside a tool call. Before this, the only path was telling the user to run a
+// shell command — which a web/Cowork agent cannot do at all, and which a stale install needs
+// most (an out-of-date MCP is exactly the session least able to ask for help). The updater
+// mechanics live in ONE place, `drafted update --yes` (cli/drafted.mjs) — do not reimplement
+// the installer command here, that's the two-writers drift.
+//
+// The `drafted` bin is resolved at the FIXED prefix first: the stdio MCP resolves from
+// ~/.drafted/npm-global, which a non-login shell's PATH does not carry, so bare `drafted`
+// finds nothing (or worse, a different install) on many machines.
+function installedDraftedBin() {
+  const prefixed = platform() === 'win32'
+    ? join(homedir(), '.drafted', 'npm-global', 'drafted.cmd')
+    : join(homedir(), '.drafted', 'npm-global', 'bin', 'drafted');
+  return existsSync(prefixed) ? prefixed : 'drafted';
+}
+
+async function updateInstalledMcp({ dryRun = false } = {}) {
+  try {
+    const metadata = await getMcpUpdateMetadata();
+    const instructions = buildInstalledMcpUpdateInstructions(metadata);
+    // Hosted HTTP MCP has no local daemon — instructions already say so.
+    if (!instructions.updateSupported) return ok({ ...instructions, action: 'update' });
+    if (dryRun) return ok({ ...instructions, action: 'update', started: false, dryRun: true });
+
+    const bin = installedDraftedBin();
+    const result = await new Promise((resolve) => {
+      execFile(bin, ['update', '--yes', '--json'], { timeout: 60_000 }, (error, stdout) => {
+        if (error) return resolve({ ok: false, error: error.code === 'ENOENT' ? `Drafted CLI not found (looked for ${bin})` : (error.killed ? 'Updater did not start within 60s' : error.message) });
+        try { resolve({ ok: true, data: JSON.parse(stdout) }); }
+        catch { resolve({ ok: true, data: null }); }
+      });
+    });
+
+    if (!result.ok) {
+      return ok({
+        ...instructions,
+        action: 'update',
+        started: false,
+        error: result.error,
+        note: `Could not start the updater from this process (${result.error}). Give the user this command to run in a terminal instead: ${instructions.manualCommand}`,
+      });
+    }
+    return ok({
+      ...instructions,
+      action: 'update',
+      started: true,
+      // Be exact about what did and did not happen: the installer runs DETACHED and does not
+      // replace the already-loaded process, so "updated" would be a lie until a restart.
+      note: 'The updater is running in the background (~30-60s). It does NOT replace this already-running MCP process: tell the user to restart their agent/editor once it finishes, then call whoami to confirm the new mcpVersion.',
+    });
+  } catch (error) { return err(error); }
+}
+
 // Session naming: set/rename THIS agent session's name — the name-before-work gate stays
 // closed until this succeeds. The name persists server-side (sessions.surface_name), so
 // reconnects and server restarts keep it and the gate never re-fires for a named session.
-tool('session', 'Name THIS agent session (and rename it later). The name is what the user sees on your surface tab — pick a short 2-3 word description of the work (e.g. "beoflow backend", "drafted fs work"). The name persists across reconnects and restarts; you only set it once unless the work changes.', {
-  action: z.enum(['name']).describe('Operation — currently only `name` (set/rename this session).'),
+tool('session', 'Manage THIS agent session. `action="name"` sets/renames it — the name is what the user sees on your surface tab, so pick a short 2-3 word description of the work (e.g. "beoflow backend"); it persists across reconnects and restarts. `action="update"` updates the npm-installed Drafted MCP on THIS machine when whoami reports mcpUpdate.stale — run it yourself instead of asking the user to run a shell command.', {
+  action: z.enum(['name', 'update']).describe('Operation: `name` (set/rename this session) or `update` (update the installed Drafted MCP on this machine).'),
   name: z.string().optional().describe('[name] the session name — a short 2-3 word description of the work (e.g. "beoflow backend"). Max 5 words / 50 chars.'),
-}, async ({ action, name }) => {
+  dryRun: z.boolean().optional().describe('[update] report what the update would do without starting it.'),
+}, async ({ action, name, dryRun }) => {
+  if (action === 'update') return updateInstalledMcp({ dryRun });
   if (action !== 'name') return err(new Error(`unknown session action: ${action}`));
   if (!name || !String(name).trim()) return err(new Error('name required — a short 2-3 word description of the work, e.g. session(action="name", name="beoflow backend")'));
   try {
@@ -2823,10 +2915,11 @@ server.resource('info', 'drafted://info', {
   };
 });
 
-tool('fs', 'Navigate Drafted like a local filesystem. An org is the top folder: `fs(ls, path="/")` lists the orgs you can address, then `/o/<org>/<root>/...` addresses one of them — the org is part of the path, there is no org switching:\n\n- `/o/<org>/wiki/<path>` — org knowledge pages (markdown, OKF; free nesting; `index.md` at any level is synthesized and read-only)\n- `/o/<org>/skills/<slug>` — reusable procedures (flat: one dir per skill slug, `SKILL.md` + supporting files inside)\n- `/o/<org>/tasks/<lane?>/<file>` — work items. A task IS a frame: `read` renders its `drafted:status:`/`drafted:assignee:` as front matter and `write`/`edit` parse them back into columns, so they are never stored in the body. The keys are namespaced so an ordinary `status:` in your own front matter is left alone. Valid statuses: open, in_progress, scheduled, needs_review, needs_decision, done, failed (an empty `drafted:status:` clears it). Status is a column, not a location — a task moved out of /tasks stays a task.\n- `/o/<org>/projects/<folder?>/<project>/<layer>/<lane>/<file>` — producible frames (folder optional; then exactly layer → lane → file)\n\n(Bare `/wiki`, `/skills`, `/tasks`, `/projects` roots still resolve via the session\'s working org.)\n\nVerbs: `ls` (list a directory), `read` (file content — hashline-annotated for text so `edit` stays surgical), `write` (create/overwrite; extension + layer classify the type: .html design, .md document, .excalidraw diagram, .xlsx/.docx office, images/videos media, .pdf asset, .google-doc/.google-sheet/.google-slide create native Google Workspace files), `edit` (hashline ops for text, element ops for excalidraw, structured ops for office), `mv` (rename/move, cross-project), `rm` (delete), `search` (frames are searched by label AND content, with the matching line returned as a snippet; `fs(search, path="/")` or `path="/o/<org>"` fans out across wiki + skills + projects in one call). `mkdir` creates a project only: use `/projects/<project>` or `/projects/<folder>/<project>`, never a layer path. To create a layer, write its first frame at `/projects/<project>/<new-layer>/<lane>/<file>`.\n\nThe project is resolved from the path itself — no separate "open" step. Guardrails are server-side and unchanged: the org in the path must be the project\'s own org (project paths under /o/<org>/ validate it), the G1 wiki-search gate fires before project mutations, attached-skill gates fire on mutations, anchored frames must be read before editing a layer, `.skillinstall/` is stripped on skill push.', {
-  action: z.enum(['ls', 'read', 'write', 'edit', 'mv', 'rm', 'mkdir', 'search']).describe('Filesystem verb.'),
+tool('fs', 'Navigate Drafted like a local filesystem. An org is the top folder: `fs(ls, path="/")` lists the orgs you can address, then `/o/<org>/<root>/...` addresses one of them — the org is part of the path, there is no org switching:\n\n- `/o/<org>/wiki/<path>` — org knowledge pages (markdown, OKF; free nesting; `index.md` at any level is synthesized and read-only)\n- `/o/<org>/skills/<slug>` — reusable procedures (flat: one dir per skill slug, `SKILL.md` + supporting files inside)\n- `/o/<org>/tasks/<lane?>/<file>` — work items. A task IS a frame: `read` renders its `drafted:status:`/`drafted:assignee:` as front matter and `write`/`edit` parse them back into columns, so they are never stored in the body. The keys are namespaced so an ordinary `status:` in your own front matter is left alone. Valid statuses: open, in_progress, scheduled, needs_review, needs_decision, done, failed (an empty `drafted:status:` clears it). Status is a column, not a location — a task moved out of /tasks stays a task.\n- `/o/<org>/projects/<folder?>/<project>/<layer>/<lane>/<file>` — producible frames (folder optional; then exactly layer → lane → file)\n\n(Bare `/wiki`, `/skills`, `/tasks`, `/projects` roots still resolve via the session\'s working org.)\n\nVerbs: `ls` (list a directory), `read` (file content — hashline-annotated for text so `edit` stays surgical), `write` (create/overwrite; extension + layer classify the type: .html design, .md document, .excalidraw diagram, .xlsx/.docx office, images/videos media, .pdf asset, .google-doc/.google-sheet/.google-slide create native Google Workspace files), `edit` (hashline ops for text, element ops for excalidraw, structured ops for office), `mv` (rename/move, cross-project), `rm` (delete), `search` (frames are searched by label AND content, with the matching line returned as a snippet; `fs(search, path="/")` or `path="/o/<org>"` fans out across wiki + skills + projects in one call), `link` / `unlink` / `links` (relate one frame to another frame, to a project, or to an external url — `links` lists a frame\'s edges plus its backlinks, and on a project path lists the tasks linked to that project; a link is stored by ID, so `mv` never breaks it). `mkdir` creates a project only: use `/projects/<project>` or `/projects/<folder>/<project>`, never a layer path. To create a layer, write its first frame at `/projects/<project>/<new-layer>/<lane>/<file>`.\n\nThe project is resolved from the path itself — no separate "open" step. Guardrails are server-side and unchanged: the org in the path must be the project\'s own org (project paths under /o/<org>/ validate it), the G1 wiki-search gate fires before project mutations, attached-skill gates fire on mutations, anchored frames must be read before editing a layer, `.skillinstall/` is stripped on skill push.', {
+  action: z.enum(['ls', 'read', 'write', 'edit', 'mv', 'rm', 'mkdir', 'search', 'link', 'unlink', 'links']).describe('Filesystem verb.'),
   path: z.string().describe('Drafted path: /o/<org>/wiki/... | /o/<org>/skills/... | /o/<org>/tasks/... | /o/<org>/projects/... (bare /wiki, /skills, /tasks, /projects also work; for mv: source)'),
-  to: z.string().optional().describe('[mv] destination path'),
+  to: z.string().optional().describe('[mv] destination path; [link/unlink] target path — a frame path, or a project path (/o/<org>/projects/<project>) to link a task to a project'),
+  url: z.string().optional().describe('[link/unlink] external target URL, instead of `to` (a link is internal-by-id OR external-by-url, never both)'),
   query: z.string().optional().describe('[search] term to match against names/content'),
   content: z.string().optional().describe('[write] inline HTML/markdown/text'),
   file_path: z.string().optional().describe('[write] absolute path to a local file to upload (stdio only). Under /projects it uploads bytes (images, PDFs, office files); under /wiki and /skills it reads the file as UTF-8 text, so a markdown file on disk can be written straight to a page or a SKILL.md without pasting it.'),
@@ -2861,10 +2954,10 @@ tool('fs', 'Navigate Drafted like a local filesystem. An org is the top folder:
     const toScoped = splitOrgScope(stripUrlOrigin(to));
     if (toScoped.error) return err(new Error(toScoped.error));
     if (toScoped.org && orgFromPath && toScoped.org.toLowerCase() !== orgFromPath.toLowerCase()) {
-      return err(new Error('mv stays within one org — source and destination must address the same org'));
+      return err(new Error(`${action} stays within one org — source and destination must address the same org`));
     }
     if (toScoped.org && !orgFromPath) {
-      return err(new Error('mv to an org-scoped destination needs an org-scoped source too (/o/<org>/... on both sides)'));
+      return err(new Error(`${action} to an org-scoped destination needs an org-scoped source too (/o/<org>/... on both sides)`));
     }
     to = toScoped.path;
   }
@@ -3180,7 +3273,7 @@ tool('fs', 'Navigate Drafted like a local filesystem. An org is the top folder:
   // so a task moved out of here stays a task.
   const isTasksPath = (x) => x === '/tasks' || x === '/tasks/' || String(x || '').startsWith('/tasks/');
   if (isTasksPath(p) || isTasksPath(to)) {
-    if (['write', 'edit', 'mv', 'rm'].includes(action)) {
+    if (['write', 'edit', 'mv', 'rm', 'link', 'unlink'].includes(action)) {
       // Project-less: the org cannot be guessed (same guard as /wiki and /skills).
       await requireBoundOrgForProjectlessMutation(org || orgFromPath);
     }
@@ -3192,7 +3285,7 @@ tool('fs', 'Navigate Drafted like a local filesystem. An org is the top folder:
     // `fs(ls, path="/tasks")` creating one would put a real "Tasks" project in
     // an org the agent never named (DRAFT-36: org is an address, not a guess).
     // Writes are guarded above and may create; reads say "nothing here yet".
-    const readOnly = !['write', 'edit', 'mv', 'rm'].includes(action);
+    const readOnly = !['write', 'edit', 'mv', 'rm', 'link', 'unlink'].includes(action);
     const sys = await api('POST', '/api/tasks/project', readOnly ? { create: false } : {}, orgHeader)
       .catch((e) => (readOnly && e.status === 404 ? null : Promise.reject(e)));
     if (!sys?.id) {
@@ -3479,6 +3572,51 @@ tool('fs', 'Navigate Drafted like a local filesystem. An org is the top folder:
           const result = await api('DELETE', `/api/fs/${rmPath.replace(/^\//, '')}`, undefined, orgHeader);
           return ok(result);
         }
+        case 'link':
+        case 'unlink': {
+          if (!filePath) return err(new Error(`${action} requires a source file path: /projects/<project>/<layer>/<lane>/<file>`));
+          const from = lane ? `/${layer}/${lane}/${filename}` : `/${layer}/${filename}`;
+          const body = { from };
+          if (args.url) {
+            body.url = args.url;
+          } else if (to) {
+            // Same destination grammar as mv: /projects/<ref>/<layer>/... is a
+            // frame in another project, /projects/<ref> alone is the project
+            // itself (the "this task belongs to that project" edge), and a bare
+            // /<layer>/... is a frame in this one.
+            const toClean = String(to).replace(/^\/+|\/+$/g, '');
+            const toParts = toClean.replace(/^projects\/?/, '').split('/').filter(Boolean);
+            if (toClean.startsWith('projects/') && toParts.length === 1) {
+              const toMeta = await resolveProjectRef(toParts[0]).catch(() => null);
+              if (!toMeta?.id) return err(new Error(`project not found: ${toParts[0]}`));
+              body.toType = 'project';
+              body.toId = toMeta.id;
+            } else if (toClean.startsWith('projects/') && toParts.length >= 2) {
+              const toRef = toParts[0];
+              const sameProject = projectRef && String(toRef).toLowerCase() === String(projectRef).toLowerCase();
+              if (!sameProject) {
+                const toMeta = await resolveProjectRef(toRef).catch(() => null);
+                if (!toMeta?.id) return err(new Error(`project not found: ${toRef}`));
+                body.toProjectId = toMeta.id;
+              }
+              body.to = '/' + toParts.slice(1).join('/');
+            } else {
+              body.to = toParts.length ? '/' + toParts.join('/') : String(to);
+            }
+          } else {
+            return err(new Error(`${action} needs a target: to="<frame or project path>" or url="https://..."`));
+          }
+          return ok(await api('POST', `/api/fs/${action}`, body, orgHeader));
+        }
+        case 'links': {
+          // On a file: its edges plus its (access-filtered) backlinks. On a
+          // project path: the tasks linked to that project.
+          if (filePath) {
+            const relPath = lane ? `/${layer}/${lane}/${filename}` : `/${layer}/${filename}`;
+            return ok(await api('GET', `/api/fs/links?path=${encodeURIComponent(relPath)}`, undefined, orgHeader));
+          }
+          return ok(await api('GET', '/api/fs/linked-tasks', undefined, orgHeader));
+        }
         case 'search': {
           // /api/fs/search has never existed — this 404'd on every call (no fs
           // route matches a single `/search` segment). /api/search is the real

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.6",
+  "version": "1.19.8",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [