drafted 1.25.9 → 1.25.10

package/mcp/server.mjs

@@ -1634,7 +1634,14 @@ async function resolveProjectRef(ref, orgHint = null) {
   if (!ref) return null;
   const cacheKey = orgHint ? `${orgHint}|${ref}` : ref;
   const hit = projectRefCache.get(cacheKey) || (!orgHint && projectRefCache.get(ref));
-  if (hit) return hit;
+  // Keep the BARE-ref key in step with a scoped hit. The fs route resolves the
+  // path's project twice: once with the path's org as the hint (the guard, and
+  // the state it records), once without one — and that second pass is what scopes
+  // the call. The unhinted pass reads `ref`, which every resolve in any org
+  // rewrites, so without this the two passes could name different orgs' projects:
+  // with `architecture` in two orgs, read home → read other → read home answered
+  // `project "architecture" is not in the addressed org` for a correct path.
+  if (hit) { projectRefCache.set(ref, hit); return hit; }
   // Scope the lookup to the org the path named. Without a hint the session's
   // org applies — which is right for `fs ls /projects` but WRONG for a path
   // that addressed another org, and that mismatch is what made a project
@@ -1647,6 +1654,7 @@ async function resolveProjectRef(ref, orgHint = null) {
     rows.find(x => String(x.slug || '').toLowerCase() === want) ||
     rows.find(x => String(x.name || '').toLowerCase() === want);
   let p = pick(list);
+  const fromHintOrg = !!p;
   // A miss is worth one unscoped look before "not found": the hint may be stale
   // (a project that moved org), and an id passed as projectId= carries no org at
   // all — only a UUID can name a project in an org the session is not inside.
@@ -1659,7 +1667,15 @@ async function resolveProjectRef(ref, orgHint = null) {
   // `folder` rides along so a caller can rebuild the project's printed address
   // (/o/<org>/projects/<folder>/<slug>) without a second lookup.
   const meta = { id: p.id, slug: p.slug || null, name: p.name || null, orgId: p.orgId || null, orgSlug: p.orgSlug || null, folder: p.folder || '' };
-  projectRefCache.set(cacheKey, meta);
+  // `<org>|<ref>` means "this ref IN THAT ORG", so only an answer that came out of
+  // that org's own listing may be stored under it. A cross-org fallback answer
+  // stored there is re-served to every later path naming that org, and the org
+  // guard then rejects a project the path never asked for: fs read/write on
+  // /o/<org-slug>/projects/<name>/... answered "project <name> is not in org
+  // <slug>" after one miss (a mkdir of a name another org owned) cached a foreign
+  // project under the slug, while the same path spelled with the org UUID — a
+  // different key — still resolved. Measured on prod 1.25.9.
+  if (fromHintOrg || !orgHint) projectRefCache.set(cacheKey, meta);
   projectRefCache.set(ref, meta);
   projectRefCache.set(p.id, meta);
   return meta;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.25.9",
+  "version": "1.25.10",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "bin": {