drafted 1.2.1 → 1.2.3

package/mcp/server.mjs

@@ -30,7 +30,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 // never see each other's session or active project.
 
 const requestState = new AsyncLocalStorage();
-const standaloneState = { sessionId: null, projectId: null };
+const standaloneState = { sessionId: null, projectId: null, projectMeta: null };
 
 function getState() {
   return requestState.getStore() || standaloneState;
@@ -111,6 +111,7 @@ const TOOL_ANNOTATIONS = {
 
   // Skills
   skill:               { title: 'Skills',              readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Manage the Drafted skill library: search, load, add, update, remove, attach/detach from projects, favorite, and edit skill files.' },
+  wiki:                { title: 'Wiki',                readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Per-org wiki. Markdown pages with paths as hierarchy. Dispatch by `action`.' },
 };
 
 function tool(name, descOrSchema, schemaOrHandler, handler) {
@@ -328,7 +329,7 @@ function ok(text, opts) {
 // Build the structuredContent shape that the frame-preview widget reads.
 // Tools that produce or return a frame (read/write/edit) call this so the
 // model and widget see the same metadata view.
-function frameStructuredContent(result) {
+function frameStructuredContent(result, project = null) {
   return {
     id: result.id,
     path: result.path || (result.layer && result.lane && result.label
@@ -341,6 +342,7 @@ function frameStructuredContent(result) {
     width: result.width,
     height: result.height,
     frameUrl: result.id ? `${getServerUrl()}/f/${result.id}` : undefined,
+    project, // {id, slug, name, orgId} of the active project — visible in client UI
   };
 }
 
@@ -371,8 +373,19 @@ function withProjectBreadcrumb(result) {
 let agentWs = null;
 let agentWsReconnectTimer = null;
 
-function setMcpActiveProject(projectId) {
-  getState().projectId = projectId;
+function setMcpActiveProject(projectId, meta = null) {
+  const s = getState();
+  s.projectId = projectId;
+  s.projectMeta = meta; // { id, slug, name, orgId } — for echo on mutation responses
+}
+
+// Returns { id, slug, name, orgId } for the project this MCP session most
+// recently opened — what frame mutations will actually target. Echoed on
+// every mutation so silent cross-project drift is visible.
+function getCurrentProjectContext() {
+  const s = getState();
+  if (!s.projectId) return null;
+  return s.projectMeta || { id: s.projectId, slug: null, name: null, orgId: null };
 }
 
 async function connectAgentWs() {
@@ -502,19 +515,108 @@ function invalidateProjectSkillsCache(projectId) {
   if (projectId) projectSkillsCache.delete(projectId);
 }
 
-async function checkProjectSkills(projectId) {
+async function checkProjectSkills(projectId, operation) {
   if (!projectId) return null;
   const skills = await getProjectSkills(projectId);
   if (skills.length === 0) return null;
   const unloaded = skills.filter(s => !loadedSkillIds.has(s.id));
   if (unloaded.length === 0) return null;
 
+  // Fire-and-forget: tell the server so any open browser shows a toast.
+  api('POST', `/api/projects/${projectId}/skill-gate-events`, {
+    unloadedSkills: unloaded.map(s => ({ id: s.id, name: s.name, slug: s.slug })),
+    operation: operation || 'mutation',
+    agent: process.env.DRAFTED_AGENT_NAME || null,
+  }).catch(() => { /* non-fatal */ });
+
   const lines = unloaded.map(s => `  skill(action="load", skill="${s.slug || s.id}")  -- ${s.name}`);
   return `This project has ${skills.length} attached skill(s) that must be loaded before making changes. ` +
     `Unloaded skills:\n${lines.join('\n')}\n\n` +
     `Load all attached skills first, then retry your operation. Skills tell you HOW to do the work — they're not optional.`;
 }
 
+// ── Org skill enforcement ────────────────────────────────────────
+// Same shape as project skill enforcement but for org-attached skills.
+// Wiki mutations require org skills to be loaded first.
+
+let cachedOrgId = null;
+let cachedOrgIdTime = 0;
+
+async function getCurrentOrgId() {
+  const ctx = await getCurrentOrgContext();
+  return ctx?.id || null;
+}
+
+// Returns { id, name } for the org bound to THIS MCP session. Each session is
+// independent on purpose — parallel agents can run on different orgs.
+async function getCurrentOrgContext() {
+  if (cachedOrgId && Date.now() - cachedOrgIdTime < 30000) return cachedOrgId;
+  try {
+    const data = await api('GET', '/auth/me');
+    if (!data?.orgId) return null;
+    cachedOrgId = { id: data.orgId, name: data.currentOrg?.name || null };
+    cachedOrgIdTime = Date.now();
+    return cachedOrgId;
+  } catch { return null; }
+}
+
+async function getOrgSkills(orgId) {
+  if (!orgId) return [];
+  // No cache: gate freshness > the ~5ms HTTP roundtrip. Otherwise an attach
+  // performed mid-session won't take effect until the cached [] expires.
+  try {
+    const result = await api('GET', `/api/orgs/${orgId}/skills`);
+    return Array.isArray(result?.skills) ? result.skills : [];
+  } catch { return []; }
+}
+
+async function checkOrgSkills(orgId, operation) {
+  if (!orgId) return null;
+  const skills = await getOrgSkills(orgId);
+  if (skills.length === 0) return null;
+  const unloaded = skills.filter(s => !loadedSkillIds.has(s.id));
+  if (unloaded.length === 0) return null;
+  const lines = unloaded.map(s => `  skill(action="load", skill="${s.slug || s.id}")  -- ${s.name}`);
+  return `This org has ${skills.length} attached skill(s) that must be loaded before making changes. ` +
+    `Unloaded skills:\n${lines.join('\n')}\n\n` +
+    `Load all attached skills first, then retry your operation. Skills tell you HOW to do the work — they're not optional.`;
+}
+
+// ── Wiki helpers ─────────────────────────────────────────────────
+
+function normalizeWikiPath(input) {
+  if (!input) return input;
+  return input.replace(/^\/+/, '').replace(/\.md$/, '');
+}
+
+function applyHashlineOps(content, operations) {
+  let lines = content.split('\n');
+  const lineToHash = {};
+  for (let i = 0; i < lines.length; i++) {
+    lineToHash[i] = createHash('sha256').update(lines[i] || '').digest('hex').slice(0, 4);
+  }
+  const sorted = [...operations].reverse();
+  for (const op of sorted) {
+    const matches = Object.entries(lineToHash).filter(([, h]) => h === op.lineHash).map(([idx]) => parseInt(idx));
+    if (matches.length === 0) throw new Error(`Line with hash "${op.lineHash}" not found`);
+    if (matches.length > 1) throw new Error(`Ambiguous hash "${op.lineHash}" matches ${matches.length} lines`);
+    const idx = matches[0];
+    if (op.type === 'replace') { lines[idx] = op.newContent; }
+    else if (op.type === 'delete') { lines.splice(idx, 1); }
+    else if (op.type === 'insertAfter') { lines.splice(idx + 1, 0, op.newContent); }
+    else if (op.type === 'insertBefore') { lines.splice(idx, 0, op.newContent); }
+  }
+  return lines.join('\n');
+}
+
+async function getTreeAsMap() {
+  const tree = await api('GET', '/api/wiki/tree');
+  const pages = tree.pages || [];
+  const pathToPage = {};
+  for (const p of pages) { pathToPage[p.path] = p; }
+  return { pages, pathToPage };
+}
+
 // ── CLI passthrough (for login/start/stop only) ───────────────────
 
 function runCLI(command, args = [], options = {}) {
@@ -686,15 +788,19 @@ tool('project', 'START HERE for project management. Dispatch by `action`: list (
         const { projectId, skipBrowser } = args;
         if (!projectId) throw new Error('projectId required for action=open');
         const result = await api('POST', '/api/project/switch', { projectId });
-        setMcpActiveProject(projectId);
         joinAgentWsRoom(projectId);
         const base = getServerUrl();
         let projectSlug = projectId;
+        let projectMeta = { id: projectId, slug: null, name: null, orgId: null };
         try {
           const data = await api('GET', '/api/projects');
           const proj = (data.projects || []).find(p => p.id === projectId);
-          if (proj?.slug) projectSlug = proj.slug;
+          if (proj) {
+            projectSlug = proj.slug || projectId;
+            projectMeta = { id: proj.id, slug: proj.slug || null, name: proj.name || null, orgId: proj.orgId || null };
+          }
         } catch { /* fall back to projectId */ }
+        setMcpActiveProject(projectId, projectMeta);
         const url = `${base}/project/${projectSlug}`;
         let navigated = 0;
         if (!skipBrowser) {
@@ -1000,28 +1106,28 @@ tool('layer', 'Manage layers in a project. Dispatch by `action`: add/update/remo
 
 tool('get_org', {}, async () => {
   try {
+    // Source of truth = THIS MCP session's bound org (what mutations will actually
+    // hit). Each session is independent on purpose — multiple agents can run in
+    // parallel against different orgs. /auth/me reads sessions.org_id directly.
+    const me = await api('GET', '/auth/me');
+    const sessionOrgId = me?.orgId || null;
+
     const data = await api('GET', '/api/orgs');
-    const orgs = data.orgs || data || [];
-    // Get members for the active org
-    const auth = JSON.parse(readFileSync(AUTH_FILE, 'utf8'));
+    const orgs = (data.orgs || data || []).map(o => ({ id: o.orgId || o.id, name: o.orgName || o.name }));
+    const activeOrg = sessionOrgId ? (orgs.find(o => o.id === sessionOrgId) || null) : null;
+
     let members = [];
-    let activeOrg = null;
-    if (auth.sessionId) {
-      // Find the active org from the session
-      const projectData = await api('GET', '/api/projects');
-      const orgId = projectData.projects?.[0]?.orgId;
-      if (orgId) {
-        activeOrg = orgs.find(o => (o.orgId || o.id) === orgId);
-        try {
-          const memberData = await api('GET', `/api/orgs/${orgId}/members`);
-          members = memberData.members || memberData || [];
-        } catch { /* no members */ }
-      }
+    if (sessionOrgId) {
+      try {
+        const memberData = await api('GET', `/api/orgs/${sessionOrgId}/members`);
+        members = memberData.members || memberData || [];
+      } catch { /* no members */ }
     }
     return ok({
-      activeOrg: activeOrg ? { id: activeOrg.orgId || activeOrg.id, name: activeOrg.orgName || activeOrg.name } : null,
-      orgs: orgs.map(o => ({ id: o.orgId || o.id, name: o.orgName || o.name })),
+      activeOrg,
+      orgs,
       members: members.map(m => ({ id: m.userId, name: m.username, email: m.email, role: m.role })),
+      note: "activeOrg is the org bound to THIS MCP session — what mutations will actually target. Browser tabs and other MCP sessions for the same user can be on different orgs.",
     });
   } catch (error) { return err(error); }
 });
@@ -1052,6 +1158,10 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
 }, async (args) => {
   try {
     const { action } = args;
+    // Echo project context on every mutation so the agent sees where the
+    // write landed before it can develop a wrong assumption.
+    const projectCtx = getCurrentProjectContext();
+    const withProject = (result) => ({ ...result, project: projectCtx });
     switch (action) {
       case 'read': {
         const { path, lines } = args;
@@ -1075,7 +1185,7 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         // structuredContent over text when both are present and structured looks
         // "complete" — so include content in BOTH places to ensure the agent
         // can always see the frame's actual content, not just metadata.
-        const structured = frameStructuredContent(result);
+        const structured = frameStructuredContent(result, projectCtx);
         structured.content = result.content ?? '';
         structured.size = result.size;
         structured.totalLines = result.totalLines;
@@ -1124,8 +1234,8 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         if (height) body.height = height;
         if (color) body.color = color;
         const result = await api('PUT', `/api/fs/${parts[0]}/${parts[1]}/${parts[2]}`, body);
-        return ok(withFrameBreadcrumb(result, { hint: true }), {
-          structuredContent: frameStructuredContent(result),
+        return ok(withProject(withFrameBreadcrumb(result, { hint: true })), {
+          structuredContent: frameStructuredContent(result, projectCtx),
           _meta: body.content ? { frameHtml: body.content } : undefined,
         });
       }
@@ -1138,8 +1248,8 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         const anchorErr = await checkAnchors(parseLayer(path));
         if (anchorErr) return err(new Error(anchorErr));
         const result = await api('POST', '/api/fs/edit', { path, operations });
-        return ok(result, {
-          structuredContent: frameStructuredContent(result),
+        return ok(withProject(result), {
+          structuredContent: frameStructuredContent(result, projectCtx),
           _meta: result.content ? { frameHtml: result.content } : undefined,
         });
       }
@@ -1152,7 +1262,7 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         if (fromErr) return err(new Error(fromErr));
         const toErr = await checkAnchors(parseLayer(to));
         if (toErr) return err(new Error(toErr));
-        return ok(await api('POST', '/api/fs/mv', { from, to }));
+        return ok(withProject(await api('POST', '/api/fs/mv', { from, to })));
       }
       case 'anchor': {
         const { path, anchored } = args;
@@ -1160,7 +1270,7 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         if (typeof anchored !== 'boolean') throw new Error('anchored (boolean) required for action=anchor');
         const skillErr = await checkProjectSkills(getState().projectId);
         if (skillErr) return err(new Error(skillErr));
-        return ok(await api('POST', '/api/fs/anchor', { path, anchored }));
+        return ok(withProject(await api('POST', '/api/fs/anchor', { path, anchored })));
       }
       case 'search': {
         const { query, projectId, limit = 50 } = args;
@@ -1248,7 +1358,7 @@ tool('ls', 'List contents of the ACTIVE PROJECT. Use ls / after project(action="
   } catch (error) { return err(error); }
 });
 
-tool('rm', 'Delete a frame or lane from the ACTIVE PROJECT. Response includes "project" field.', {
+tool('rm', 'Delete a frame or lane from the ACTIVE PROJECT. Response includes "project" field so you see where the deletion landed.', {
   path: z.string().describe('Path to delete: /{layer}/{lane}/{filename} or /{layer}/{lane} (deletes entire lane).'),
 }, async ({ path }) => {
   try {
@@ -1258,7 +1368,7 @@ tool('rm', 'Delete a frame or lane from the ACTIVE PROJECT. Response includes "p
     if (anchorErr) return err(new Error(anchorErr));
     const clean = path.replace(/^\/+|\/+$/g, '');
     const result = await api('DELETE', `/api/fs/${clean}`);
-    return ok(result);
+    return ok({ ...result, project: getCurrentProjectContext() });
   } catch (error) { return err(error); }
 });
 
@@ -1657,6 +1767,284 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
   } catch (error) { return err(error); }
 });
 
+// ── Wiki tool (org-scoped, no project needed) ─────────────────────
+// All 11 actions dispatch from one tool. Read-only actions skip the
+// skill gate; mutations require org-level wiki-maintainer skills loaded.
+
+tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and other agents/humans share maintenance — every edit broadcasts live, and edits from others appear in `recent` and on `read`.\n\nBefore mutating: check `recent` and `search` for relevant existing pages. Before mv/rm: check `links` (or pass `dryRun=true`). After completing a logical session of work, append a `log` entry.\n\nThe tool handles bookkeeping you\'d otherwise forget: `mv` rewrites inbound references via the link index, `read` shows who edited last and when. Use `health` to find unlinked pages and broken links.\n\n**Skill gate:** the org may attach a `wiki-maintainer` skill that you MUST load before mutations. If you get a skill-gate error, run skill(action="load", skill="wiki-maintainer") then retry.', {
+  action: z.enum(['ls', 'recent', 'read', 'search', 'links', 'log', 'health', 'write', 'edit', 'mv', 'rm']).describe('Operation to perform.'),
+  path: z.string().optional().describe('[ls|read|links] wiki path. For ls: default / (root). For read: required. For links: required.'),
+  recursive: z.boolean().optional().describe('[ls] list recursively with depth indicators'),
+  limit: z.number().optional().describe('[recent|search] max results (recent default 10, search default 25)'),
+  query: z.string().optional().describe('[search] term to search in title, path, and content'),
+  lines: z.string().optional().describe('[read] line range (e.g. "1-50"). Omit to read all.'),
+  message: z.string().optional().describe('[log] message to append to log.md page'),
+  title: z.string().optional().describe('[write] page title (required for write)'),
+  content: z.string().optional().describe('[write|edit] page content (write: full content; edit: hashline content not used — use operations)'),
+  type: z.string().optional().describe('[write] page type (default "page")'),
+  frontmatter: z.any().optional().describe('[write] frontmatter object'),
+  operations: z.array(z.object({
+    type: z.enum(['replace', 'delete', 'insertAfter', 'insertBefore']).describe('Edit type'),
+    lineHash: z.string().describe('4-char hash of the target line (from read output)'),
+    newContent: z.string().optional().describe('New content (for replace, insertAfter, insertBefore)'),
+  })).optional().describe('[edit] hashline edit operations — same shape as frame.edit'),
+  from: z.string().optional().describe('[mv] source path'),
+  to: z.string().optional().describe('[mv] destination path'),
+  dryRun: z.boolean().optional().describe('[mv|rm] preview impact without applying changes'),
+}, async (args) => {
+  try {
+    const { action } = args;
+
+    // Resolve org context once for the wiki tool. Each MCP session is bound
+    // to one org (parallel agents on different orgs is supported by design).
+    const orgCtx = await getCurrentOrgContext();
+    const orgId = orgCtx?.id || null;
+    // Mutation responses include `org` so the agent always sees where the
+    // write landed — eliminates silent cross-org confusion.
+    const withOrg = (result) => ({ ...result, org: orgCtx });
+
+    // ── Skill gate: all mutation actions ──────────────────────────
+    const MUTATING = new Set(['write', 'edit', 'mv', 'rm', 'log']);
+    if (MUTATING.has(action)) {
+      const skillErr = await checkOrgSkills(orgId, action);
+      if (skillErr) return err(new Error(skillErr));
+    }
+
+    switch (action) {
+
+      // ── ls ──────────────────────────────────────────────────────
+      case 'ls': {
+        const { path: lsPath = '/', recursive: lsRecursive = false } = args;
+        const { pages, pathToPage } = await getTreeAsMap();
+        const parent = normalizeWikiPath(lsPath);
+
+        if (lsRecursive) {
+          // Full tree under path with depth
+          const prefix = parent ? parent + '/' : '';
+          const filtered = !parent ? pages : pages.filter(p => p.path === parent || p.path.startsWith(prefix));
+          const tree = filtered.map(p => ({
+            depth: !parent ? p.path.split('/').length - 1 : p.path.split('/').length - parent.split('/').length - (p.path === parent ? 1 : 0),
+            path: p.path,
+            title: p.title,
+            type: p.type,
+            id: p.id,
+          }));
+          return ok({ tree });
+        }
+
+        // Non-recursive: children of parent path
+        if (!parent) {
+          // Root: show top-level directories + root pages
+          const dirs = new Set();
+          const rootPages = [];
+          for (const p of pages) {
+            if (!p.path.includes('/')) { rootPages.push(p); }
+            else { dirs.add(p.path.split('/')[0]); }
+          }
+          return ok({
+            tree: [
+              ...Array.from(dirs).sort().map(d => ({ type: 'directory', name: d })),
+              ...rootPages.map(p => ({ type: 'page', path: p.path, title: p.title, id: p.id })),
+            ],
+          });
+        }
+
+        // Has parent: show immediate children
+        const children = [];
+        const seenDirs = new Set();
+        const prefix = parent + '/';
+        for (const p of pages) {
+          if (p.path === parent) {
+            children.push({ type: 'page', path: p.path, title: p.title, id: p.id });
+          } else if (p.path.startsWith(prefix)) {
+            const rest = p.path.slice(prefix.length);
+            if (rest.includes('/')) {
+              const sub = rest.split('/')[0];
+              if (!seenDirs.has(sub)) { seenDirs.add(sub); children.push({ type: 'directory', name: parent + '/' + sub }); }
+            } else {
+              children.push({ type: 'page', path: p.path, title: p.title, id: p.id });
+            }
+          }
+        }
+        return ok({ tree: children });
+      }
+
+      // ── recent ──────────────────────────────────────────────────
+      case 'recent': {
+        const { limit: recentLimit = 10 } = args;
+        const tree = await api('GET', '/api/wiki/tree');
+        const recent = (tree.pages || [])
+          .filter(p => p.updatedAt)
+          .sort((a, b) => new Date(b.updatedAt) - new Date(a.updatedAt))
+          .slice(0, Math.max(1, recentLimit))
+          .map(p => ({ path: p.path, title: p.title, updatedAt: p.updatedAt }));
+        return ok({ pages: recent });
+      }
+
+      // ── read ────────────────────────────────────────────────────
+      case 'read': {
+        const { path: readPath, lines: readLines } = args;
+        if (!readPath) throw new Error('path required for action=read');
+        const normalized = normalizeWikiPath(readPath);
+        const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`);
+        // Client-side line slice — server returns full content; we trim if `lines` was passed.
+        let outContent = page.content;
+        if (readLines && typeof outContent === 'string') {
+          const m = readLines.match(/^(\d+)-(\d+)$/);
+          if (!m) throw new Error(`lines must be "N-M" (e.g. "10-50"), got: ${readLines}`);
+          const [start, end] = [parseInt(m[1]), parseInt(m[2])];
+          const allLines = outContent.split('\n');
+          outContent = allLines.slice(Math.max(0, start - 1), end).join('\n');
+        }
+        // Get backlink count via search (approximate)
+        let backlinkCount = 0;
+        try {
+          const searchRes = await api('GET', `/api/wiki/search?q=${encodeURIComponent(normalized)}`);
+          backlinkCount = (searchRes.hits || []).length;
+        } catch { /* best-effort */ }
+        return ok({
+          path: page.path,
+          title: page.title,
+          type: page.type,
+          frontmatter: page.frontmatter,
+          content: outContent,
+          lastEditedBy: page.updatedBy,
+          lastEditedAt: page.updatedAt,
+          backlinkCount,
+        });
+      }
+
+      // ── search ──────────────────────────────────────────────────
+      case 'search': {
+        const { query: searchQuery, limit: searchLimit = 25 } = args;
+        if (!searchQuery) throw new Error('query required for action=search');
+        const result = await api('GET', `/api/wiki/search?q=${encodeURIComponent(searchQuery)}&limit=${searchLimit}`);
+        const hits = (result.hits || []).map(h => ({ path: h.path, title: h.title }));
+        return ok({ hits });
+      }
+
+      // ── links ───────────────────────────────────────────────────
+      case 'links': {
+        const { path: linksPath } = args;
+        if (!linksPath) throw new Error('path required for action=links');
+        const normalized = normalizeWikiPath(linksPath);
+        const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`);
+        return ok(await api('GET', `/api/wiki/pages/${page.id}/links`));
+      }
+
+      // ── log ─────────────────────────────────────────────────────
+      case 'log': {
+        const { message: logMessage } = args;
+        if (!logMessage) throw new Error('message required for action=log');
+        const agentName = process.env.DRAFTED_AGENT_NAME || 'mcp';
+        const dateStr = new Date().toISOString().replace('T', ' ').slice(0, 19) + 'Z';
+        const entry = `## ${dateStr} note by ${agentName} | ${logMessage}`;
+
+        // Try to read existing log page
+        let existingContent = '';
+        let existingId = null;
+        try {
+          const logPage = await api('GET', '/api/wiki/page?path=log');
+          existingContent = logPage.content || '';
+          existingId = logPage.id;
+        } catch {
+          // Create new log page
+          const created = await api('POST', '/api/wiki/pages', {
+            path: 'log',
+            title: 'Log',
+            content: entry + '\n',
+          });
+          return ok(withOrg({ appended: true, created: true, pageId: created.id }));
+        }
+
+        // Append to existing log
+        const updatedContent = (existingContent.endsWith('\n') ? existingContent : existingContent + '\n') + entry + '\n';
+        await api('PATCH', `/api/wiki/pages/${existingId}`, { content: updatedContent });
+        return ok(withOrg({ appended: true }));
+      }
+
+      // ── health ──────────────────────────────────────────────────
+      case 'health': {
+        return ok(await api('GET', '/api/wiki/health'));
+      }
+
+      // ── write ───────────────────────────────────────────────────
+      case 'write': {
+        const { path: writePath, title: writeTitle, content: writeContent, type: writeType, frontmatter } = args;
+        if (!writePath) throw new Error('path required for action=write');
+        if (!writeTitle) throw new Error('title required for action=write');
+        const normalized = normalizeWikiPath(writePath);
+        const body = { path: normalized, title: writeTitle };
+        if (writeContent !== undefined) body.content = writeContent;
+        if (writeType) body.type = writeType;
+        if (frontmatter !== undefined) body.frontmatter = frontmatter;
+
+        // Check if page exists — if so, update; otherwise create
+        try {
+          const existing = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`);
+          const result = await api('PATCH', `/api/wiki/pages/${existing.id}`, body);
+          return ok(withOrg({ path: result.path, title: result.title, id: result.id, updated: true }));
+        } catch {
+          const result = await api('POST', '/api/wiki/pages', body);
+          return ok(withOrg({ path: result.path, title: result.title, id: result.id, created: true }));
+        }
+      }
+
+      // ── edit ────────────────────────────────────────────────────
+      case 'edit': {
+        const { path: editPath, operations: editOps } = args;
+        if (!editPath) throw new Error('path required for action=edit');
+        if (!Array.isArray(editOps) || editOps.length === 0) throw new Error('operations (array) required for action=edit');
+        const normalized = normalizeWikiPath(editPath);
+        const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`);
+        const newContent = applyHashlineOps(page.content || '', editOps);
+        const result = await api('PATCH', `/api/wiki/pages/${page.id}`, { content: newContent });
+        return ok(withOrg({ path: result.path, id: result.id, updated: true }));
+      }
+
+      // ── mv ──────────────────────────────────────────────────────
+      case 'mv': {
+        const { from: mvFrom, to: mvTo, dryRun: mvDryRun = false } = args;
+        if (!mvFrom) throw new Error('from (source path) required for action=mv');
+        if (!mvTo) throw new Error('to (destination path) required for action=mv');
+        const fromPath = normalizeWikiPath(mvFrom);
+        const toPath = normalizeWikiPath(mvTo);
+        if (fromPath === toPath) throw new Error('source and destination are the same');
+
+        const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(fromPath)}`);
+
+        if (mvDryRun) {
+          const { referrers } = await api('GET', `/api/wiki/pages/${page.id}/referrers`);
+          return ok(withOrg({ impacted: referrers.map(r => ({ path: r.path, title: r.title })) }));
+        }
+
+        // Server-side cascade: /move rewrites referrers in one transaction
+        const moved = await api('PATCH', `/api/wiki/pages/${page.id}/move`, { path: toPath });
+        return ok(withOrg({ path: moved.path, title: moved.title, id: moved.id, referrersUpdated: moved.referrersUpdated ?? 0 }));
+      }
+
+      // ── rm ──────────────────────────────────────────────────────
+      case 'rm': {
+        const { path: rmPath, dryRun: rmDryRun = false } = args;
+        if (!rmPath) throw new Error('path required for action=rm');
+        const normalized = normalizeWikiPath(rmPath);
+        const page = await api('GET', `/api/wiki/page?path=${encodeURIComponent(normalized)}`);
+        const { referrers } = await api('GET', `/api/wiki/pages/${page.id}/referrers`);
+        const broken = referrers.map(r => ({ path: r.path, title: r.title }));
+
+        if (rmDryRun) {
+          return ok(withOrg({ brokenAfterDelete: broken }));
+        }
+        await api('DELETE', `/api/wiki/pages/${page.id}`);
+        return ok(withOrg({ deleted: true, path: normalized, id: page.id, brokenReferences: broken }));
+      }
+
+      default:
+        throw new Error(`Unknown wiki action: ${action}`);
+    }
+  } catch (error) { return err(error); }
+});
+
 // ── Resource: canvas info ─────────────────────────────────────────
 
 server.resource('info', 'drafted://info', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Drafted CLI - Design preview server for Claude agents",
   "type": "module",
   "files": [
@@ -40,6 +40,7 @@
     "dotenv": "^17.3.1",
     "drizzle-orm": "^0.45.1",
     "express": "^4.18.2",
+    "mdast-util-from-markdown": "^2.0.3",
     "multer": "^2.1.1",
     "nodemailer": "^8.0.2",
     "pg": "^8.20.0",