drafted 1.25.1 → 1.25.3

package/cli/drafted.mjs

@@ -2244,6 +2244,79 @@ async function minionSetEnabled(id, enabled, format) {
   emitMinionResult(format, { status: 'ok', id: c.id, slug: c.slug, name: c.name });
 }
 
+// ── Actions: propose an outward effect and read its decision ─────────────
+// The seam a Causeway automation's approval@1 step uses (Approvals inbox, A5/C4):
+// propose, then poll status until a person decides in the org's Approvals inbox.
+// Approving stays a browser-only act in Drafted; nothing here can approve.
+const actionCmd = program.command('action').description('Propose an outward effect for a person to approve, and read its decision');
+
+function actionState(actions) {
+  const st = (actions || []).map((a) => a.status);
+  if (!st.length) return 'unknown';
+  if (st.every((s) => s === 'proposed')) return 'waiting';
+  if (st.includes('rejected')) return 'rejected';
+  if (st.includes('failed')) return 'failed';
+  if (st.every((s) => s === 'executed')) return 'executed';
+  return 'approved';
+}
+
+async function actionApi(method, apiPath, org, body) {
+  requireLogin();
+  const server = getServerUrl().replace(/\/$/, '');
+  const headers = { ...(org ? { 'X-Drafted-Org': org } : {}), ...(body ? { 'Content-Type': 'application/json' } : {}) };
+  const res = await authFetch(`${server}${apiPath}`, { method, headers, body: body ? JSON.stringify(body) : undefined });
+  const data = await res.json().catch(() => ({}));
+  return { ok: res.ok, status: res.status, data };
+}
+
+actionCmd
+  .command('propose')
+  .description('Propose from JSON {type,payload} or {actions:[{type,payload}...]}, plus optional reason and assignee (an org member email or user id; default you). Reads --file or stdin.')
+  .option('--file <path>', 'JSON file (default: stdin)')
+  .option('--org <org>', 'org (id or slug) to propose in')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    let req;
+    try { req = opts.file ? JSON.parse(readFileSync(opts.file, 'utf8')) : readStdinJSON(); }
+    catch { console.error('invalid JSON request'); process.exit(1); }
+    const body = Array.isArray(req.actions) ? { actions: req.actions } : { actions: [{ type: req.type, payload: req.payload || {} }] };
+    if (req.reason) body.reason = String(req.reason);
+    if (req.assignee) body.assignee = String(req.assignee);
+    const r = await actionApi('POST', '/api/actions', opts.org, body);
+    const out = r.ok
+      ? { status: 'ok', groupId: r.data.groupId, url: r.data.receipt && r.data.receipt.url, assignee: r.data.assignee || null }
+      : { status: 'error', error: r.data.detail || r.data.error || `HTTP ${r.status}`, code: r.data.error || null };
+    if (opts.format === 'json') console.log(JSON.stringify(out));
+    else console.log(r.ok ? `${out.groupId}\t${out.url || ''}` : `error\t${out.error}`);
+    if (!r.ok) process.exit(1);
+  });
+
+actionCmd
+  .command('status <groupId>')
+  .description('A proposal\'s decision: waiting, approved, executed, failed or rejected, with who decided and why')
+  .option('--org <org>', 'org (id or slug) it was proposed in')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (groupId, opts) => {
+    const r = await actionApi('GET', `/api/actions/groups/${encodeURIComponent(groupId)}`, opts.org);
+    if (!r.ok) {
+      const out = { status: 'error', error: r.data.detail || r.data.error || `HTTP ${r.status}`, code: r.data.error || null };
+      if (opts.format === 'json') console.log(JSON.stringify(out)); else console.log(`error\t${out.error}`);
+      process.exit(1);
+    }
+    const acts = r.data.actions || [];
+    const out = {
+      status: 'ok',
+      groupId,
+      state: actionState(acts),
+      decidedBy: r.data.decidedBy ? r.data.decidedBy.name : null,
+      note: r.data.decisionNote || null,
+      assignee: r.data.assignee ? r.data.assignee.name : null,
+      steps: acts.map((a) => ({ seq: a.seq, type: a.type, status: a.status, error: (a.result && a.result.error) || null })),
+    };
+    if (opts.format === 'json') console.log(JSON.stringify(out));
+    else console.log(`${out.state}\t${out.decidedBy || ''}\t${out.note || ''}`);
+  });
+
 const minionCmd = program.command('minion').description('Minion management (checklist-driven intake surfaces). Requires the agent allowlist.');
 
 minionCmd

package/mcp/server.mjs

@@ -2952,10 +2952,11 @@ tool('action', {
   actions: z.string().optional().describe('[propose] JSON array of {type,payload} to approve TOGETHER as one chain — e.g. share with three people, then comment tagging them. One screen, one decision. Execution is sequential and stops at the first failure; a sent email cannot be rolled back, so it is never all-or-nothing.'),
   groupId: z.string().optional().describe('[read] The chain to read.'),
   reason: z.string().optional().describe('[propose] One line telling the approver WHY. They see it next to what the action does.'),
+  assignee: z.string().optional().describe('[propose] Whose Approvals inbox it lands in: an org member\'s email or user id. Omit it and it lands in yours (the user this session runs as). It routes, it does not decide who may approve; a send_email can only ever be assigned to you, the mailbox owner. An unknown or non-member assignee is refused with the member list.'),
   limit: z.number().optional().describe('[list] Default 25.'),
   offset: z.number().optional().describe('[list] Default 0.'),
   compact: z.boolean().optional().describe('[list] Identity fields only.'),
-}, async ({ action, type, payload, actions, groupId, reason, limit, offset, compact }) => {
+}, async ({ action, type, payload, actions, groupId, reason, assignee, limit, offset, compact }) => {
   try {
     if (action === 'propose') {
       let items;
@@ -2970,10 +2971,11 @@ tool('action', {
       const result = await api('POST', '/api/actions', {
         actions: items,
         ...(reason ? { reason: String(reason) } : {}),
+        ...(assignee ? { assignee: String(assignee) } : {}),
       });
       return ok({
         ...result,
-        next: 'Proposed. A person must approve this in Drafted before anything is sent — you cannot approve it yourself, and there is no verb here that would let you.',
+        next: `Proposed, and waiting in ${result?.assignee?.name ? result.assignee.name + "'s" : 'the'} Approvals inbox (receipt.url opens it). A person must approve it in Drafted before anything is sent — you cannot approve it yourself, and there is no verb here that would let you.`,
       });
     }
     if (action === 'read') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.25.1",
+  "version": "1.25.3",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "bin": {

package/src/shared/root-route.mjs

@@ -43,3 +43,26 @@ export function parseRootPath(pathname) {
     path: path,
   };
 }
+
+/**
+ * Org-level views: pages that belong to the ORG, not to a folder, so they take
+ * no folder chain and are not roots (a folder may still be named after one).
+ * /o/<org>/approvals[/<groupId>] is the Approvals inbox: an approval is
+ * org-scoped, and showing it inside some project was the old bug.
+ */
+export const ORG_VIEWS = ['approvals'];
+
+/**
+ * @param {string} pathname
+ * @returns {{orgParam: string, root: string, path: string}|null}
+ *   Same contract as parseRootPath, minus the folder chain. ZERO backslashes,
+ *   for the same template-literal reason.
+ */
+export function parseOrgViewPath(pathname) {
+  var re = new RegExp('^/o/([^/]+)/(approvals)(?:/(.*))?$');
+  var m = re.exec(String(pathname || ''));
+  if (!m) return null;
+  var path = m[3] || '';
+  while (path.length && path.charAt(path.length - 1) === '/') path = path.slice(0, -1);
+  return { orgParam: decodeURIComponent(m[1]), root: m[2], path: path };
+}