drafted 1.19.9 → 1.19.16

package/mcp/server.mjs

@@ -198,6 +198,17 @@ function scrubLocalPathMentions(description) {
 // inside the factory so each HTTP request gets its own isolated server.
 // Stdio mode uses the `mcpServer` singleton (built once at module load).
 
+// What an fs(rm) on a project path actually targets. A layer or lane path carries
+// no filename, so before this predicate existed it fell through to the "no file
+// path = archive the project" branch and archived the WHOLE project — returning a
+// normal-looking success. That is how "Ai For Coaches Talk" was lost to an
+// fs(rm) on /slides/deck. Only the bare project path may archive.
+export function rmScope(layer, lane, filename) {
+  if (filename) return 'file';
+  if (layer || lane) return 'directory';
+  return 'project';
+}
+
 // ── Org-ambiguity policy (the one decision core) ─────────────────
 // The org guard inside the factory plumbs session/HTTP state into this
 // side-effect-free predicate, which IS the policy (DRAFT-36 "one rule"). Top-level
@@ -391,6 +402,7 @@ const TOOL_ANNOTATIONS = {
   session:             { title: 'Session',              readOnlyHint: false, destructiveHint: false, openWorldHint: false, description: 'Name THIS agent session (and rename it later). The name is what the user sees on your surface tab — pick a short 2-3 word description of the work (e.g. "beoflow backend", "drafted fs work"). The name persists across reconnects and restarts; you only set it once unless the work changes. Dispatch by `action`: `name` (set/rename with the `name` param) or `update` (update the npm-installed Drafted MCP on THIS machine when whoami reports mcpUpdate.stale — run it yourself rather than handing the user a shell command; `dryRun` reports without starting it).' },
 
   // Comments — the review loop agents could previously only reach over raw HTTP
+  action:              { title: 'Propose an action',   readOnlyHint: false, destructiveHint: false, openWorldHint: false, description: 'Propose an outward effect for a HUMAN to approve — sharing a project or file, changing someone\'s role, minting a public link, or @mentioning someone in a comment. These are the operations that reach OUTSIDE the org: they grant access to a person or contact them, and they cannot be undone by editing a frame. You can propose and read; you cannot approve. Approving is the send, it happens server-side from a frozen snapshot, and there is no verb here that would let an agent trigger it. Everything INSIDE the org — writing frames, wiki pages, skills, task status — needs no proposal: just do it.' },
   comment:             { title: 'Comments',              readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Read and write review comments on frames. Comments are notes ABOUT THE WORK: they attach to a frame, optionally to one element inside it, and anyone who can see the frame sees them. Dispatch by `action`: list (paginated, compact mode), add (with an optional element anchor or a reply), resolve, reopen, delete. Use this to leave findings a human can action in place, and to read the feedback they left you.' },
 
   // Canvas / view
@@ -2547,6 +2559,58 @@ tool('tour', {
   } catch (error) { return err(error); }
 });
 
+// ── action: propose an outward effect; a HUMAN approving is what executes ──
+//
+// There is deliberately NO execute/approve verb here, on any transport. The gate
+// is not "the agent may send once approved" — approving IS the send, server-side,
+// from a frozen snapshot. A spendable permission is a capability that can later be
+// re-pointed at content the human never read. See SECURITY.md.
+tool('action', {
+  action: z.enum(['propose', 'list', 'read']).describe('propose: ask a human to authorise one outward effect, or a chain of them approved together. list: your org\'s pending proposals. read: one chain with every payload as the approver will see it.'),
+  type: z.string().optional().describe('[propose] One of: share_project, share_frame, change_share_role, create_public_frame_link, create_public_lane_link, comment_mention. Anything else is refused — the list is fixed in source, not data.'),
+  payload: z.string().optional().describe('[propose] JSON object for this type. share_project {projectId,email,role}; share_frame {frameId,email,role}; change_share_role {shareId,role}; create_public_frame_link {frameId}; create_public_lane_link {projectId,layer,lane}; comment_mention {frameId,body,email}. Optional expiresInHours on the share types.'),
+  actions: z.string().optional().describe('[propose] JSON array of {type,payload} to approve TOGETHER as one chain — e.g. share with three people, then comment tagging them. One screen, one decision. Execution is sequential and stops at the first failure; a sent email cannot be rolled back, so it is never all-or-nothing.'),
+  groupId: z.string().optional().describe('[read] The chain to read.'),
+  reason: z.string().optional().describe('[propose] One line telling the approver WHY. They see it next to what the action does.'),
+  limit: z.number().optional().describe('[list] Default 25.'),
+  offset: z.number().optional().describe('[list] Default 0.'),
+  compact: z.boolean().optional().describe('[list] Identity fields only.'),
+}, async ({ action, type, payload, actions, groupId, reason, limit, offset, compact }) => {
+  try {
+    if (action === 'propose') {
+      let items;
+      if (actions) {
+        const parsed = JSON.parse(actions);
+        if (!Array.isArray(parsed) || !parsed.length) throw new Error('actions must be a non-empty JSON array of {type,payload}');
+        items = parsed;
+      } else {
+        if (!type) throw new Error('type is required for action propose (or pass `actions` for a chain)');
+        items = [{ type, payload: payload ? JSON.parse(payload) : {} }];
+      }
+      const result = await api('POST', '/api/actions', {
+        actions: items,
+        ...(reason ? { reason: String(reason) } : {}),
+      });
+      return ok({
+        ...result,
+        next: 'Proposed. A person must approve this in Drafted before anything is sent — you cannot approve it yourself, and there is no verb here that would let you.',
+      });
+    }
+    if (action === 'read') {
+      if (!groupId) throw new Error('groupId is required for action read');
+      return ok(await api('GET', `/api/actions/groups/${encodeURIComponent(groupId)}`));
+    }
+    const qs = new URLSearchParams();
+    if (limit != null) qs.set('limit', String(limit));
+    if (offset != null) qs.set('offset', String(offset));
+    if (compact) qs.set('compact', '1');
+    const q = qs.toString();
+    return ok(await api('GET', `/api/actions${q ? '?' + q : ''}`));
+  } catch (e) {
+    return err(e);
+  }
+});
+
 tool('comment', {
   action: z.enum(['list', 'add', 'resolve', 'reopen', 'delete']).describe('list: read comments (paginated). add: post a comment or a reply. resolve/reopen: flip a comment\'s state. delete: remove one.'),
   target: z.string().optional().describe('[list, add] The frame: a path (/projects/<project>/<layer>/<lane>/<file>), a frame URL, or a frame UUID. Required for add. For list, omit it to read the whole project.'),
@@ -3562,7 +3626,19 @@ tool('fs', 'Navigate Drafted like a local filesystem. An org is the top folder:
           // __archived folder. Frame/lane rm still deletes those items, but a
           // whole project is never hard-deleted by an agent — the web UI's
           // Archive bin is where a human permanently deletes.
-          if (!filePath) {
+          // A layer or lane path has no filename, so it used to fall through to
+          // the archive branch and archive the WHOLE project — with a
+          // success-shaped response. /slides/deck and /slides are one keystroke
+          // from the project path; only the bare project path may archive.
+          const scope = rmScope(layer, lane, filename);
+          if (scope === 'directory') {
+            return err(new Error(
+              `rm on a ${lane ? 'lane' : 'layer'} path deletes nothing — Drafted has no directory delete. ` +
+              `Remove the frames individually: /projects/<project>/${layer}${lane ? '/' + lane : ''}/<file>. ` +
+              `To archive the whole project, address the project itself: /projects/<project>`
+            ));
+          }
+          if (scope === 'project') {
             const pid = getState().projectId;
             if (!pid) return err(new Error('could not resolve project id for archive'));
             const result = await api('PATCH', `/api/project/${pid}`, { folder: '__archived' }, orgHeader);

package/mcp/test-org-guards.mjs

@@ -5,7 +5,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
-import { projectlessMutationNeedsOrg, boundOrgRejected, receiptOrg, splitOrgScope, stripUrlOrigin } from './server.mjs';
+import { projectlessMutationNeedsOrg, boundOrgRejected, receiptOrg, splitOrgScope, stripUrlOrigin, rmScope } from './server.mjs';
 import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';
 
 // One rule governs create AND fork (a fork is a create). A write proceeds when its
@@ -168,6 +168,16 @@ assert.equal(stripUrlOrigin('/o/acme/wiki/x'), '/o/acme/wiki/x', 'plain paths pa
 assert.equal(stripUrlOrigin('not a url'), 'not a url', 'non-URL input passes through');
 assert.equal(stripUrlOrigin('/f/00000000-0000-0000-0000-000000000000'), '/f/00000000-0000-0000-0000-000000000000', '/f/ frame links pass through');
 
+// fs(rm) scope: only a BARE project path may archive a project. A lane path
+// (/slides/deck) and a layer path (/slides) both parse with filename=null and
+// used to fall through to the archive branch, silently archiving the whole
+// project with a success-shaped response.
+assert.equal(rmScope('slides', 'deck', '12.html'), 'file', 'a full frame path removes that frame');
+assert.equal(rmScope('slides', null, '12.html'), 'file', 'a layer-root file path removes that frame');
+assert.equal(rmScope('slides', 'deck', null), 'directory', 'a LANE path must never archive the project');
+assert.equal(rmScope('slides', null, null), 'directory', 'a LAYER path must never archive the project');
+assert.equal(rmScope(null, null, null), 'project', 'only the bare project path archives the project');
+
 console.log('org-guard policy OK');
 // Importing server.mjs builds the stdio MCP singleton, which opens a WS reconnect
 // loop that keeps the event loop alive. Assertions are done — exit deterministically.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.9",
+  "version": "1.19.16",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [