drafted 1.25.0 → 1.25.2

package/cli/drafted.mjs

@@ -1679,8 +1679,9 @@ program
 // docs/contracts/drafted-skill-sync.md.
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
-// synthesizeSkillMd builds a self-describing SKILL.md. Drafted stores `content`
-// as the body only (name/description/triggerPatterns are columns), so we prepend
+// synthesizeSkillMd builds a self-describing SKILL.md. name/description/
+// triggerPatterns are columns, and `content` may still carry the author's own
+// frontmatter (merged by splitStoredFrontmatter), so we prepend
 // YAML frontmatter — JSON scalars are valid YAML — for Causeway's projection and
 // Claude's native loader to read.
 // normalizeSetup mirrors the server (server/lib/skill-hash.mjs) — keep in lockstep.
@@ -1690,6 +1691,31 @@ function normalizeSetup(setup) {
   return arr.filter((s) => typeof s === 'string' && s.trim().length > 0);
 }
 
+// Keys synthesizeSkillMd writes from the skill row's columns. The row is the
+// authority for these, so a copy of one in the stored content is dropped.
+const COLUMN_KEYS = new Set(['name', 'description', 'triggerPatterns', 'setup', 'type', 'title', 'tags', 'timestamp']);
+
+// Content written through fs/MCP keeps the author's frontmatter. Emitting it
+// as-is after the synthesized block gave every such SKILL.md TWO frontmatter
+// blocks (56 of 267 live skills on 2026-10-24), and loaders read only the
+// first, so author keys such as a Causeway `chain:` or `allowed-tools` were
+// lost on export. Split it: the author's other top-level keys, verbatim, join
+// the one block; the rest is the body. Line-based so the author's formatting
+// survives byte for byte; content with no frontmatter is returned unchanged.
+function splitStoredFrontmatter(content) {
+  const text = content || '';
+  const m = /^---\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/.exec(text);
+  if (!m) return { extra: [], body: text };
+  const extra = [];
+  let keep = false;
+  for (const line of m[1].split(/\r?\n/)) {
+    const key = /^([A-Za-z_][\w.-]*)\s*:/.exec(line);
+    if (key) keep = !COLUMN_KEYS.has(key[1]);
+    if (keep) extra.push(line);
+  }
+  return { extra, body: text.slice(m[0].length) };
+}
+
 function synthesizeSkillMd(skill) {
   const lines = ['---', `name: ${JSON.stringify(skill.name || skill.slug || '')}`];
   if (skill.description) lines.push(`description: ${JSON.stringify(skill.description)}`);
@@ -1719,8 +1745,9 @@ function synthesizeSkillMd(skill) {
   }
   const ts = skill.updatedAt ? new Date(skill.updatedAt) : null;
   if (ts && !Number.isNaN(ts.getTime())) lines.push(`timestamp: ${JSON.stringify(ts.toISOString())}`);
-  lines.push('---', '');
-  return lines.join('\n') + (skill.content || '');
+  const { extra, body } = splitStoredFrontmatter(skill.content);
+  lines.push(...extra, '---', '');
+  return lines.join('\n') + body;
 }
 
 // bundleHash is a stable content hash over the bundle (sorted path\0content\0),

package/mcp/server.mjs

@@ -2952,10 +2952,11 @@ tool('action', {
   actions: z.string().optional().describe('[propose] JSON array of {type,payload} to approve TOGETHER as one chain — e.g. share with three people, then comment tagging them. One screen, one decision. Execution is sequential and stops at the first failure; a sent email cannot be rolled back, so it is never all-or-nothing.'),
   groupId: z.string().optional().describe('[read] The chain to read.'),
   reason: z.string().optional().describe('[propose] One line telling the approver WHY. They see it next to what the action does.'),
+  assignee: z.string().optional().describe('[propose] Whose Approvals inbox it lands in: an org member\'s email or user id. Omit it and it lands in yours (the user this session runs as). It routes, it does not decide who may approve; a send_email can only ever be assigned to you, the mailbox owner. An unknown or non-member assignee is refused with the member list.'),
   limit: z.number().optional().describe('[list] Default 25.'),
   offset: z.number().optional().describe('[list] Default 0.'),
   compact: z.boolean().optional().describe('[list] Identity fields only.'),
-}, async ({ action, type, payload, actions, groupId, reason, limit, offset, compact }) => {
+}, async ({ action, type, payload, actions, groupId, reason, assignee, limit, offset, compact }) => {
   try {
     if (action === 'propose') {
       let items;
@@ -2970,10 +2971,11 @@ tool('action', {
       const result = await api('POST', '/api/actions', {
         actions: items,
         ...(reason ? { reason: String(reason) } : {}),
+        ...(assignee ? { assignee: String(assignee) } : {}),
       });
       return ok({
         ...result,
-        next: 'Proposed. A person must approve this in Drafted before anything is sent — you cannot approve it yourself, and there is no verb here that would let you.',
+        next: `Proposed, and waiting in ${result?.assignee?.name ? result.assignee.name + "'s" : 'the'} Approvals inbox (receipt.url opens it). A person must approve it in Drafted before anything is sent — you cannot approve it yourself, and there is no verb here that would let you.`,
       });
     }
     if (action === 'read') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.25.0",
+  "version": "1.25.2",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "bin": {

package/src/shared/root-route.mjs

@@ -43,3 +43,26 @@ export function parseRootPath(pathname) {
     path: path,
   };
 }
+
+/**
+ * Org-level views: pages that belong to the ORG, not to a folder, so they take
+ * no folder chain and are not roots (a folder may still be named after one).
+ * /o/<org>/approvals[/<groupId>] is the Approvals inbox: an approval is
+ * org-scoped, and showing it inside some project was the old bug.
+ */
+export const ORG_VIEWS = ['approvals'];
+
+/**
+ * @param {string} pathname
+ * @returns {{orgParam: string, root: string, path: string}|null}
+ *   Same contract as parseRootPath, minus the folder chain. ZERO backslashes,
+ *   for the same template-literal reason.
+ */
+export function parseOrgViewPath(pathname) {
+  var re = new RegExp('^/o/([^/]+)/(approvals)(?:/(.*))?$');
+  var m = re.exec(String(pathname || ''));
+  if (!m) return null;
+  var path = m[3] || '';
+  while (path.length && path.charAt(path.length - 1) === '/') path = path.slice(0, -1);
+  return { orgParam: decodeURIComponent(m[1]), root: m[2], path: path };
+}