drafted 1.7.26 → 1.8.1

package/install-mcp.sh

@@ -507,34 +507,64 @@ NODE
 install_agent_instructions "$HOME/.claude/CLAUDE.md" "Claude global instructions"
 install_agent_instructions "$HOME/.codex/CODEX.md" "Codex global instructions"
 
-# ── Skills ───────────────────────────────────────────────────────
+# ── Skills & commands ─────────────────────────────────────────────
 
-step "Installing skills"
+step "Installing skills and commands"
 
-# Find the installed package's skills directory
+# Resolve the plugin source: a local checkout when present (e.g. --local from this
+# repo), otherwise the installed npm package's bundled plugin/ directory.
 DRAFTED_PKG_DIR="$(node -e "try { console.log(require.resolve('drafted/package.json').replace('/package.json','')) } catch { process.exit(1) }" 2>/dev/null)" || true
+if [ -d "$SCRIPT_DIR/plugin/skills" ] || [ -d "$SCRIPT_DIR/plugin/commands" ]; then
+  PLUGIN_SRC="$SCRIPT_DIR/plugin"
+elif [ -n "$DRAFTED_PKG_DIR" ] && [ -d "$DRAFTED_PKG_DIR/plugin" ]; then
+  PLUGIN_SRC="$DRAFTED_PKG_DIR/plugin"
+else
+  PLUGIN_SRC=""
+fi
 
-if [ -n "$DRAFTED_PKG_DIR" ] && [ -d "$DRAFTED_PKG_DIR/skills" ]; then
+# Skills — Claude Code auto-loads these from ~/.claude/skills/<name>/SKILL.md
+if [ -n "$PLUGIN_SRC" ] && [ -d "$PLUGIN_SRC/skills" ]; then
   SKILLS_DIR="$HOME/.claude/skills"
   mkdir -p "$SKILLS_DIR"
-  INSTALLED=0
-  # Copy individual skill files
-  for f in "$DRAFTED_PKG_DIR/skills/"*.md; do
-    [ -f "$f" ] || continue
-    cp "$f" "$SKILLS_DIR/"
-    INSTALLED=$((INSTALLED + 1))
-  done
-  # Copy skill directories
-  for d in "$DRAFTED_PKG_DIR/skills/"*/; do
+  SKILL_COUNT=0
+  for d in "$PLUGIN_SRC/skills/"*/; do
     [ -d "$d" ] || continue
     DIRNAME="$(basename "$d")"
     rm -rf "$SKILLS_DIR/$DIRNAME"
     cp -r "$d" "$SKILLS_DIR/$DIRNAME"
-    INSTALLED=$((INSTALLED + 1))
+    SKILL_COUNT=$((SKILL_COUNT + 1))
   done
-  ok "Installed $INSTALLED skills to $SKILLS_DIR"
+  ok "Installed $SKILL_COUNT skill(s) to $SKILLS_DIR"
+else
+  echo -e "    ${YELLOW}Skill source not found in package — skipping skills.${RESET}"
+fi
+
+# Commands — namespaced under drafted/ so they register as /drafted:<name>,
+# matching the marketplace install and the commands' own cross-references.
+if [ -n "$PLUGIN_SRC" ] && [ -d "$PLUGIN_SRC/commands" ]; then
+  CMD_COUNT=0
+  for f in "$PLUGIN_SRC/commands/"*.md; do
+    [ -f "$f" ] || continue
+    CMD_COUNT=$((CMD_COUNT + 1))
+  done
+
+  if [ "$CLIENT_CLAUDE_CODE" = true ]; then
+    CLAUDE_CMD_DIR="$HOME/.claude/commands/drafted"
+    rm -rf "$CLAUDE_CMD_DIR"
+    mkdir -p "$CLAUDE_CMD_DIR"
+    cp "$PLUGIN_SRC/commands/"*.md "$CLAUDE_CMD_DIR/" 2>/dev/null || true
+    ok "Installed $CMD_COUNT command(s) to $CLAUDE_CMD_DIR"
+  fi
+
+  if [ "$CLIENT_CODEX" = true ]; then
+    CODEX_CMD_DIR="$HOME/.codex/prompts/drafted"
+    rm -rf "$CODEX_CMD_DIR"
+    mkdir -p "$CODEX_CMD_DIR"
+    cp "$PLUGIN_SRC/commands/"*.md "$CODEX_CMD_DIR/" 2>/dev/null || true
+    ok "Installed $CMD_COUNT command(s) to $CODEX_CMD_DIR"
+  fi
 else
-  echo -e "    ${YELLOW}Skills directory not found in package — skipping.${RESET}"
+  echo -e "    ${YELLOW}Command source not found in package — skipping commands.${RESET}"
 fi
 
 

package/mcp/gates.mjs

@@ -0,0 +1,124 @@
+// Pure gate logic for the Drafted compounding harness.
+//
+// These helpers are intentionally side-effect free (no `api()`, no network, no
+// module state) so they can be unit tested in isolation. mcp/server.mjs imports
+// them and wires the decisions into the tool handlers + per-session getState().
+//
+// See docs/plans/compounding-harness.md and the Drafted "gates-checklist" frame.
+
+// One combined per-project budget for the auto-injected priming set:
+// attached-skill bodies + project anchor bodies + the active layer's rules.
+// Single source of truth lives in src/shared so the server-side deposit caps
+// enforce the identical limit. Re-exported here for the MCP gate helpers.
+import { PROJECT_CONTEXT_BUDGET_CHARS, selectWithinBudget } from '../src/shared/gate-budget.mjs';
+export { PROJECT_CONTEXT_BUDGET_CHARS, selectWithinBudget };
+
+// ── Per-session gate flags (reset every MCP session) ──────────────────────────
+
+export function createGateState() {
+  return { wikiSearched: false, skillSearched: false, templateSearched: false };
+}
+
+// kind: 'wiki' | 'skill' | 'template'
+export function markSearched(gateState, kind) {
+  if (kind === 'wiki') gateState.wikiSearched = true;
+  else if (kind === 'skill') gateState.skillSearched = true;
+  else if (kind === 'template') gateState.templateSearched = true;
+  return gateState;
+}
+
+// ── Enforce gates (create chain). Return an error string if blocked, else null ─
+
+export function g1Block(gateState, wikiIndex) {
+  if (gateState.wikiSearched) return null;
+  let msg =
+    'G1: search the org wiki before reading or editing anything. ' +
+    'Call wiki(action="search", query="<relevant terms>") first, then retry. ' +
+    'More knowledge = less searching — start by drawing on what the org already knows.';
+  if (wikiIndex) msg += `\n\nWiki index (what exists to search):\n${wikiIndex}`;
+  return msg;
+}
+
+export function g2Block(gateState) {
+  if (gateState.skillSearched) return null;
+  return (
+    'G2: search for prior-art skills before creating one. ' +
+    'Call skill(action="search", query="<topic>") first — if a close match exists, improve it ' +
+    '(/drafted:improve-skill) instead of duplicating — then retry skill(action="add").'
+  );
+}
+
+export function g3Block(gateState) {
+  const missing = [];
+  if (!gateState.wikiSearched) missing.push('wiki(action="search")');
+  if (!gateState.skillSearched) missing.push('skill(action="search")');
+  if (!gateState.templateSearched) missing.push('template(action="list")');
+  if (missing.length === 0) return null;
+  return (
+    `G3: search before creating a project. Run ${missing.join(', ')} first ` +
+    '(reuse existing knowledge, skills, and templates), then retry project(action="create").'
+  );
+}
+
+// ── Per-project context budget (auto-inject set) ──────────────────────────────
+
+function itemChars(it) {
+  if (typeof it === 'number') return it;
+  if (typeof it === 'string') return it.length;
+  if (it && typeof it === 'object') {
+    if (typeof it.chars === 'number') return it.chars;
+    if (it.content != null) return String(it.content).length;
+  }
+  return 0;
+}
+
+export function sumChars(items) {
+  if (!Array.isArray(items)) return 0;
+  return items.reduce((total, it) => total + itemChars(it), 0);
+}
+
+export function budgetRemaining(currentTotal, budget = PROJECT_CONTEXT_BUDGET_CHARS) {
+  return Math.max(0, budget - currentTotal);
+}
+
+export function wouldExceedBudget(currentTotal, addChars, budget = PROJECT_CONTEXT_BUDGET_CHARS) {
+  return currentTotal + addChars > budget;
+}
+
+export function budgetError(currentTotal, addChars, label, budget = PROJECT_CONTEXT_BUDGET_CHARS) {
+  const remaining = budgetRemaining(currentTotal, budget);
+  return (
+    `Per-project context budget exceeded: ${label} needs ${addChars} chars but only ${remaining} ` +
+    `of ${budget} remain. Tighten existing attached skills / anchors / layer rules first ` +
+    `(see /drafted:improve-project-harness).`
+  );
+}
+
+// ── G6 layer-rule default detection ───────────────────────────────────────────
+
+// A layer prompt is "default" (skip G6 inject) when it is empty or byte-identical
+// to the template's default prompt for that layer key.
+export function isLayerPromptDefault(layerPrompt, templateDefaultPrompt) {
+  const p = (layerPrompt ?? '').trim();
+  if (p === '') return true;
+  const d = (templateDefaultPrompt ?? '').trim();
+  return d !== '' && p === d;
+}
+
+export function shouldInjectLayerPrompt(layerPrompt, templateDefaultPrompt) {
+  return !isLayerPromptDefault(layerPrompt, templateDefaultPrompt);
+}
+
+// ── Wiki index formatting (bounded map injected with the G1 block) ────────────
+
+export function formatWikiIndex(pages, max = 50) {
+  if (!Array.isArray(pages) || pages.length === 0) return '(wiki is empty — no pages yet)';
+  const lines = pages.slice(0, max).map((p) => {
+    const path = typeof p === 'string' ? p : p.path ?? p.slug ?? '';
+    const title = typeof p === 'object' && p && p.title ? ` — ${p.title}` : '';
+    return `  ${path}${title}`;
+  });
+  const more = pages.length > max ? `\n  …and ${pages.length - max} more` : '';
+  return lines.join('\n') + more;
+}
+

package/mcp/server.mjs

@@ -20,6 +20,16 @@ import { registerAppResource, RESOURCE_MIME_TYPE } from '@modelcontextprotocol/e
 import WebSocket from 'ws';
 import { LAYERS } from '../src/shared/constants.mjs';
 import { emptyExcalidrawScene, excalidrawSceneFromMermaid, stringifyExcalidrawScene } from '../src/shared/excalidraw.mjs';
+import { createGateState, markSearched, g1Block, g2Block, g3Block, selectWithinBudget, wouldExceedBudget, budgetError, formatWikiIndex, PROJECT_CONTEXT_BUDGET_CHARS } from './gates.mjs';
+
+// Frame actions that mutate content — gated by G1 (wiki search before editing).
+// Read-style actions (read, search, versions, get_*/read_*) are exempt.
+const G1_MUTATING_FRAME_ACTIONS = new Set([
+  'write', 'write_excalidraw', 'edit', 'mv', 'anchor', 'restore_version',
+  'write_sheet_values', 'append_sheet_rows', 'clear_sheet_range', 'update_sheet',
+  'write_doc_content', 'append_doc_content', 'clear_doc_content', 'update_doc',
+  'write_slide_content', 'append_slides', 'clear_slides', 'update_slide',
+]);
 const { UMAMI_EVENTS, trackUmamiEvent } = await (async () => {
   try {
     return await import('../server/lib/umami.mjs');
@@ -76,6 +86,7 @@ function getOrCreateSessionState(sid) {
       activeProjectId: null,
       activeProjectMeta: null,
       loadedSkillIds: new Set(),
+      gates: createGateState(),
       cachedOrgId: null,
       cachedOrgIdTime: 0,
       wsSessionId: null,
@@ -112,6 +123,23 @@ export function runWithRequestState(initial, fn) {
 // Stripped from the advertised schema on remote transports.
 const LOCAL_ONLY_PARAMS = ['file_path'];
 
+// Per-tool params whose value is arbitrary / deeply-nested JSON. Zod renders
+// these (z.any(), z.array(z.any()), z.object({}).passthrough()) as an UNTYPED
+// schema — an empty `{}` or an array whose `items` has no `type`. ChatGPT's
+// connector import runs OpenAI's strict Structured-Outputs JSON-Schema
+// validator over the whole `tools/list` and rejects the ENTIRE connector if any
+// tool contains an untyped subschema (Claude tolerates it; ChatGPT does not).
+// On remote transports we advertise each of these as a single JSON-encoded
+// string (always a valid typed schema) and parse it back to an object in the
+// tool wrapper before the handler runs — so the stdio contract, the Zod runtime
+// validation, and every handler stay byte-for-byte unchanged.
+const REMOTE_JSON_STRING_PARAMS = {
+  frame: ['excalidraw_data', 'requests'],
+  wiki: ['frontmatter', 'pages'],
+  project: ['layers'],
+  template: ['layers'],
+};
+
 // Remove sentences that reference local-file params from a tool description,
 // so remote-transport descriptions don't mention options that were stripped.
 function scrubLocalPathMentions(description) {
@@ -290,6 +318,15 @@ function tool(name, descOrSchema, schemaOrHandler, handler) {
         inputSchema[k] = field.describe(scrubLocalPathMentions(field.description));
       }
     }
+    // Present arbitrary-JSON params as a JSON string so the advertised schema is
+    // ChatGPT-valid (untyped `{}` subschemas fail OpenAI's strict validator and
+    // fail the whole connector). The wrapper below parses them back.
+    for (const k of (REMOTE_JSON_STRING_PARAMS[name] || [])) {
+      const field = inputSchema[k];
+      if (!field) continue;
+      const orig = field.description ? ` ${field.description}` : '';
+      inputSchema[k] = z.string().optional().describe(`JSON-encoded value — pass a JSON string.${orig}`);
+    }
     description = scrubLocalPathMentions(description);
   }
   const config = {
@@ -316,6 +353,17 @@ function tool(name, descOrSchema, schemaOrHandler, handler) {
     try {
       const requiredUpdateError = await getRequiredMcpUpdateError(name, args?.[0] || {});
       if (requiredUpdateError) return err(new Error(requiredUpdateError));
+      // Reverse the remote JSON-string encoding (see REMOTE_JSON_STRING_PARAMS)
+      // so handlers receive the same object/array shapes they get on stdio.
+      if (isRemote && args?.[0] && typeof args[0] === 'object') {
+        for (const k of (REMOTE_JSON_STRING_PARAMS[name] || [])) {
+          const v = args[0][k];
+          if (typeof v === 'string' && v.trim()) {
+            try { args[0][k] = JSON.parse(v); }
+            catch { return err(new Error(`Param "${k}" must be a JSON-encoded ${k === 'excalidraw_data' || k === 'frontmatter' ? 'object' : 'array'} string; JSON.parse failed.`)); }
+          }
+        }
+      }
       return await cb(...args);
     } finally {
       state.currentTool = previousTool;
@@ -921,94 +969,10 @@ function err(error) {
   return { content: [{ type: 'text', text: error.message || String(error) }], isError: true };
 }
 
-// ── Anchor enforcement ────────────────────────────────────────────
-// Track which frames this session has fully read (no line range = full read)
-const readFrameIds = new Set();
-
-// Cache anchored frames (refreshed on each check)
-let anchoredCache = null;
-let anchoredCacheTime = 0;
-
-async function getAnchoredFrames() {
-  // Cache for 10 seconds to avoid hammering the API
-  if (anchoredCache && Date.now() - anchoredCacheTime < 10000) return anchoredCache;
-  try {
-    anchoredCache = await api('GET', '/api/designs/anchored');
-    anchoredCacheTime = Date.now();
-    return anchoredCache;
-  } catch {
-    return [];
-  }
-}
-
 function parseLayer(path) {
   return path.replace(/^\/+/, '').split('/')[0];
 }
 
-async function checkAnchors(layer) {
-  const anchored = await getAnchoredFrames();
-  if (!Array.isArray(anchored)) return null;
-
-  const layerAnchors = anchored.filter(f => f.layer === layer);
-  if (layerAnchors.length === 0) return null;
-
-  const unread = layerAnchors.filter(f => !readFrameIds.has(f.id));
-  if (unread.length === 0) return null;
-
-  const paths = unread.map(f => `/${f.layer}/${f.lane}/${f.label}`);
-  return `This layer has ${layerAnchors.length} anchored frame(s) that must be read before making changes. ` +
-    `Unread anchors:\n${paths.map(p => '  read path="' + p + '"').join('\n')}\n\n` +
-    `Read all anchored frames first, then retry your operation.`;
-}
-
-// ── Project skill enforcement ─────────────────────────────────────
-// Skills attached to a project must be loaded by the agent before any
-// mutating operation in that project. Same shape as anchor enforcement.
-//
-// Loaded-skill state is per-MCP-session (see getSessionState) so that
-// (a) skill.load + wiki.write across separate HTTP requests stay coherent
-// and (b) one user's loads never satisfy another user's gate.
-const projectSkillsCache = new Map(); // projectId -> { data, time }
-
-async function getProjectSkills(projectId) {
-  if (!projectId) return [];
-  const cached = projectSkillsCache.get(projectId);
-  if (cached && Date.now() - cached.time < 10000) return cached.data;
-  try {
-    const result = await api('GET', `/api/projects/${projectId}/skills`);
-    const skills = Array.isArray(result?.skills) ? result.skills : (Array.isArray(result) ? result : []);
-    projectSkillsCache.set(projectId, { data: skills, time: Date.now() });
-    return skills;
-  } catch {
-    return [];
-  }
-}
-
-function invalidateProjectSkillsCache(projectId) {
-  if (projectId) projectSkillsCache.delete(projectId);
-}
-
-async function checkProjectSkills(projectId, operation) {
-  if (!projectId) return null;
-  const skills = await getProjectSkills(projectId);
-  if (skills.length === 0) return null;
-  const loaded = getSessionState().loadedSkillIds;
-  const unloaded = skills.filter(s => !loaded.has(s.id));
-  if (unloaded.length === 0) return null;
-
-  // Fire-and-forget: tell the server so any open browser shows a toast.
-  api('POST', `/api/projects/${projectId}/skill-gate-events`, {
-    unloadedSkills: unloaded.map(s => ({ id: s.id, name: s.name, slug: s.slug })),
-    operation: operation || 'mutation',
-    agent: process.env.DRAFTED_AGENT_NAME || null,
-  }).catch(() => { /* non-fatal */ });
-
-  const lines = unloaded.map(s => `  skill(action="load", skill="${s.slug || s.id}")  -- ${s.name}`);
-  return `This project has ${skills.length} attached skill(s) that must be loaded before making changes. ` +
-    `Unloaded skills:\n${lines.join('\n')}\n\n` +
-    `Load all attached skills first, then retry your operation. Skills tell you HOW to do the work — they're not optional.`;
-}
-
 // ── Org skill enforcement ────────────────────────────────────────
 // Same shape as project skill enforcement but for org-attached skills.
 // Wiki mutations require org skills to be loaded first.
@@ -1043,6 +1007,42 @@ async function getOrgSkills(orgId) {
   } catch { return []; }
 }
 
+// Sum the per-project priming content (attached skill bodies + project anchor
+// bodies) so deposits can be capped against the per-project context budget (G4/G5).
+async function getProjectPrimingSize(projectId) {
+  if (!projectId) return 0;
+  let total = 0;
+  try {
+    const { skills = [] } = (await api('GET', `/api/projects/${projectId}/skills`)) || {};
+    for (const s of skills) {
+      try { const full = await api('GET', `/api/skills/${s.id}`); total += (full?.content || '').length; } catch { /* skip */ }
+    }
+  } catch { /* skills unavailable */ }
+  try {
+    const anchored = await api('GET', `/api/designs/anchored?projectId=${projectId}`);
+    for (const a of (Array.isArray(anchored) ? anchored : [])) total += (a?.content || '').length;
+  } catch { /* anchors unavailable */ }
+  return total;
+}
+
+// Best-effort size (chars) of a frame's content by path / URL / id — for the
+// anchor deposit cap. Returns 0 if it can't be read (cap then allows).
+async function getFrameContentSize(path) {
+  try {
+    const s = String(path);
+    const frameId = s.match(/\/f\/([a-f0-9-]{36})/)?.[1] || (s.match(/^[a-f0-9-]{36}$/) ? s : null);
+    let result;
+    if (frameId) {
+      result = await api('GET', `/api/fs/by-id/${frameId}`);
+    } else {
+      const parts = s.replace(/^\/+/, '').split('/');
+      if (parts.length !== 3) return 0;
+      result = await api('GET', `/api/fs/${parts[0]}/${parts[1]}/${parts[2]}`);
+    }
+    return (result?.content || '').length;
+  } catch { return 0; }
+}
+
 async function checkOrgSkills(orgId, operation) {
   if (!orgId) return null;
   const skills = await getOrgSkills(orgId);
@@ -1323,42 +1323,62 @@ tool('project', 'START HERE for project management. Dispatch by `action`: list (
             exec(`${cmd} ${JSON.stringify(url)}`);
           }
         }
-        let projectSkillsList = [];
-        try {
-          const skillData = await api('GET', `/api/projects/${projectId}/skills`);
-          projectSkillsList = skillData.skills || [];
-        } catch { /* skills not available yet */ }
-
-        if (projectSkillsList.length > 0 && projectSkillsList.length <= 3) {
+        // G4/G5 auto-inject (locked design): the project's attached skills + anchors
+        // are pushed into the open response within the per-project context budget,
+        // replacing the reject-style gate. Prefer the server-computed `priming`
+        // (authoritative + fresh on deploy); fall back to MCP-side assembly for
+        // older servers that don't return it.
+        let responseExtras;
+        const priming = result && result.priming ? result.priming : null;
+        if (priming) {
+          const primedSkills = priming.skills || [];
+          const primedAnchors = priming.anchors || [];
+          for (const s of primedSkills) getSessionState().loadedSkillIds.add(s.id);
+          responseExtras = { url, opened: true, navigated, skills: primedSkills, anchors: primedAnchors };
+          if (priming.budgetNotice) responseExtras.budgetNotice = priming.budgetNotice;
+        } else {
+          let projectSkillsList = [];
+          try {
+            const skillData = await api('GET', `/api/projects/${projectId}/skills`);
+            projectSkillsList = skillData.skills || [];
+          } catch { /* skills not available yet */ }
           for (const s of projectSkillsList) {
             try {
               const full = await api('GET', `/api/skills/${s.id}`);
               s.content = full.content;
               s.files = full.files || [];
-              // Skill content was inlined in this response — count it as loaded
-              // so the project-skill gate doesn't immediately demand a re-load.
-              getSessionState().loadedSkillIds.add(s.id);
-            } catch { /* skip */ }
+            } catch { /* leaves this skill without inlined content */ }
           }
-        }
-
-        // Refresh project-skill cache so the gate uses fresh data after open
-        invalidateProjectSkillsCache(projectId);
-
-        const responseExtras = { url, opened: true, navigated, skills: projectSkillsList };
-        if (projectSkillsList.length > 3) {
-          const sessionLoaded = getSessionState().loadedSkillIds;
-          const unloaded = projectSkillsList.filter(s => !sessionLoaded.has(s.id));
-          if (unloaded.length > 0) {
-            responseExtras.skillGateNotice =
-              `This project has ${projectSkillsList.length} attached skills (too many to auto-inline). ` +
-              `You MUST call skill(action="load") for each before any mutation. Unloaded: ` +
-              unloaded.map(s => s.slug || s.id).join(', ');
+          let anchors = [];
+          try {
+            const anchored = await api('GET', `/api/designs/anchored?projectId=${projectId}`);
+            anchors = (Array.isArray(anchored) ? anchored : []).map(a => ({
+              id: a.id,
+              path: a.path || `/${a.layer || ''}/${a.lane || ''}/${a.label || ''}`,
+              layer: a.layer,
+              content: a.content || '',
+            }));
+          } catch { /* anchors unavailable */ }
+          const sel = selectWithinBudget([...projectSkillsList, ...anchors], PROJECT_CONTEXT_BUDGET_CHARS);
+          for (const it of sel.included) {
+            if (projectSkillsList.includes(it)) getSessionState().loadedSkillIds.add(it.id);
+          }
+          for (const it of sel.deferred) { it.content = undefined; if ('files' in it) it.files = undefined; }
+          responseExtras = { url, opened: true, navigated, skills: projectSkillsList, anchors };
+          if (sel.deferred.length > 0) {
+            responseExtras.budgetNotice =
+              `${sel.deferred.length} attached skill(s)/anchor(s) exceeded the per-project context budget ` +
+              `(${PROJECT_CONTEXT_BUDGET_CHARS} chars) and were not inlined — load explicitly if needed: ` +
+              sel.deferred.map(it => it.slug || it.path || it.id).join(', ');
           }
         }
+        // Don't echo the raw priming blob (surfaced via skills/anchors/budgetNotice).
+        if (result && typeof result === 'object') delete result.priming;
         return ok({ ...result, ...responseExtras });
       }
       case 'create': {
+        const g3 = g3Block(getSessionState().gates);
+        if (g3) return err(new Error(g3));
         const { name, description, templateSlug } = args;
         if (!name) throw new Error('name required for action=create');
         const body = { name };
@@ -1400,8 +1420,11 @@ tool('template', 'Manage project templates in the org. Dispatch by `action`: lis
   try {
     const { action } = args;
     switch (action) {
-      case 'list':
-        return ok(await api('GET', '/api/templates'));
+      case 'list': {
+        const tpls = await api('GET', '/api/templates');
+        markSearched(getSessionState().gates, 'template');
+        return ok(tpls);
+      }
       case 'create': {
         const { name, description, layers, skillSlugs, visibility } = args;
         if (!name || !description || !layers) throw new Error('name, description, layers required for action=create');
@@ -1536,8 +1559,6 @@ tool('layer', 'Manage layers in a project. Dispatch by `action`: add/update/remo
   try {
     const { action, projectId } = args;
     if (!projectId) throw new Error('projectId is required');
-    const skillErr = await checkProjectSkills(projectId);
-    if (skillErr) return err(new Error(skillErr));
     switch (action) {
       case 'add': {
         const { key, label, type, width, height, description, prompt } = args;
@@ -1849,11 +1870,11 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
     bullets: z.array(z.string()).optional(),
     speakerNotes: z.string().optional(),
     layout: z.string().optional(),
-  }).passthrough()).optional().describe('[write_slide_content|append_slides] Structured slide spec: [{ title, bullets, speakerNotes?, layout? }].'),
+  })).optional().describe('[write_slide_content|append_slides] Structured slide spec: [{ title, bullets, speakerNotes?, layout? }].'),
   requests: z.array(z.any()).optional().describe('[update_doc|update_slide] Raw Google Docs/Slides batchUpdate requests for advanced updates only; common Doc/Slide population should use write_doc_content/append_doc_content/write_slide_content/append_slides.'),
   slideObjectIds: z.array(z.string()).optional().describe('[clear_slides] Optional slide object IDs to delete. Omit to clear all slides.'),
   range: z.string().optional().describe('[Sheet value actions] A1 range, e.g. Sheet1!A1 or Data!A:Z.'),
-  values: z.array(z.array(z.any())).optional().describe('[write_sheet_values|append_sheet_rows] 2D array of row values.'),
+  values: z.array(z.array(z.union([z.string(), z.number(), z.boolean(), z.null()]))).optional().describe('[write_sheet_values|append_sheet_rows] 2D array of row values (each cell: string, number, boolean, or null).'),
   valueInputOption: z.enum(['RAW', 'USER_ENTERED']).optional().describe('[write_sheet_values|append_sheet_rows] Google Sheets value input option. Defaults to USER_ENTERED.'),
   majorDimension: z.enum(['ROWS', 'COLUMNS']).optional().describe('[Sheet value actions] Major dimension for values. Defaults to ROWS when writing/appending.'),
   valueRenderOption: z.enum(['FORMATTED_VALUE', 'UNFORMATTED_VALUE', 'FORMULA']).optional().describe('[read_sheet_values] How values should be rendered. Defaults to Google Sheets API default.'),
@@ -1884,6 +1905,16 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
 }, async (args) => {
   try {
     const { action } = args;
+    // G1: don't edit frame content before the session has searched the wiki.
+    // When blocking, auto-inject the (bounded) wiki index so the search lands.
+    if (G1_MUTATING_FRAME_ACTIONS.has(action)) {
+      const gs = getSessionState().gates;
+      if (!gs.wikiSearched) {
+        let wikiIndex = '';
+        try { const tree = await api('GET', '/api/wiki/tree'); wikiIndex = formatWikiIndex(tree?.pages || []); } catch { /* index best-effort */ }
+        return err(new Error(g1Block(gs, wikiIndex)));
+      }
+    }
     // Echo project context on every mutation so the agent sees where the
     // write landed before it can develop a wrong assumption.
     const projectCtx = getCurrentProjectContext();
@@ -1924,9 +1955,6 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
           if (parts.length !== 3) throw new Error('Path must be /{layer}/{lane}/{filename}, a frame URL, or a frame ID');
           result = await api('GET', `/api/fs/${parts[0]}/${parts[1]}/${parts[2]}${query}`);
         }
-        if (!lines && result.ok && result.id) {
-          readFrameIds.add(result.id);
-        }
         // Surface content as the visible text. Some Claude clients prefer
         // structuredContent over text when both are present and structured looks
         // "complete" — so include content in BOTH places to ensure the agent
@@ -2058,10 +2086,6 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         const writeSources = [content != null, !!file_path, base64 != null, !!googleType].filter(Boolean).length;
         if (writeSources > 1) throw new Error('Provide only one of content, file_path, base64, or googleType');
         if (writeSources === 0) throw new Error('Provide content, file_path, base64, or googleType');
-        const skillErr = await checkProjectSkills(getState().projectId);
-        if (skillErr) return err(new Error(skillErr));
-        const anchorErr = await checkAnchors(parseLayer(path));
-        if (anchorErr) return err(new Error(anchorErr));
         const parts = path.replace(/^\/+/, '').split('/');
         if (parts.length !== 3) throw new Error('Path must be /{layer}/{lane}/{filename}');
         if (googleType) {
@@ -2123,10 +2147,6 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         const { path, excalidraw_data, mermaid, width, height, color } = args;
         if (!path) throw new Error('path required for action=write_excalidraw');
         if (excalidraw_data != null && mermaid) throw new Error('Provide only one of excalidraw_data or mermaid');
-        const skillErr = await checkProjectSkills(getState().projectId);
-        if (skillErr) return err(new Error(skillErr));
-        const anchorErr = await checkAnchors(parseLayer(path));
-        if (anchorErr) return err(new Error(anchorErr));
         const parts = path.replace(/^\/+/, '').split('/');
         if (parts.length !== 3) throw new Error('Path must be /{layer}/{lane}/{filename}');
         const filename = parts[2].toLowerCase().endsWith('.excalidraw') ? parts[2] : parts[2] + '.excalidraw';
@@ -2145,10 +2165,6 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         const { path, operations } = args;
         if (!path) throw new Error('path required for action=edit');
         if (!Array.isArray(operations) || operations.length === 0) throw new Error('operations (array) required for action=edit');
-        const skillErr = await checkProjectSkills(getState().projectId);
-        if (skillErr) return err(new Error(skillErr));
-        const anchorErr = await checkAnchors(parseLayer(path));
-        if (anchorErr) return err(new Error(anchorErr));
         const result = await api('POST', '/api/fs/edit', { path, operations });
         return ok(withProject(result), {
           structuredContent: frameStructuredContent(result, projectCtx),
@@ -2170,20 +2186,19 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
             note: 'No changes applied. Re-call with dryRun=false (or omit) to perform the rename.',
           }));
         }
-        const skillErr = await checkProjectSkills(getState().projectId);
-        if (skillErr) return err(new Error(skillErr));
-        const fromErr = await checkAnchors(parseLayer(from));
-        if (fromErr) return err(new Error(fromErr));
-        const toErr = await checkAnchors(parseLayer(to));
-        if (toErr) return err(new Error(toErr));
         return ok(withProject(await api('POST', '/api/fs/mv', { from, to })));
       }
       case 'anchor': {
         const { path, anchored } = args;
         if (!path) throw new Error('path required for action=anchor');
         if (typeof anchored !== 'boolean') throw new Error('anchored (boolean) required for action=anchor');
-        const skillErr = await checkProjectSkills(getState().projectId);
-        if (skillErr) return err(new Error(skillErr));
+        // Cap (G5): anchoring adds the frame's body to the project's required-reading
+        // set — reject if it would push the project past the per-project budget.
+        if (anchored === true) {
+          const used = await getProjectPrimingSize(getState().projectId);
+          const addSize = await getFrameContentSize(path);
+          if (wouldExceedBudget(used, addSize)) return err(new Error(budgetError(used, addSize, 'this anchored frame')));
+        }
         return ok(withProject(await api('POST', '/api/fs/anchor', { path, anchored })));
       }
 
@@ -2202,8 +2217,6 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
       case 'restore_version': {
         const { versionId, reason } = args;
         if (!versionId) throw new Error('versionId required for action=restore_version');
-        const skillErr = await checkProjectSkills(getState().projectId);
-        if (skillErr) return err(new Error(skillErr));
         const result = await api('POST', '/api/fs/restore-version', { versionId, reason });
         return ok(withProject(result));
       }
@@ -2297,10 +2310,6 @@ tool('rm', 'Delete a frame or lane from the ACTIVE PROJECT. Response includes "p
   path: z.string().describe('Path to delete: /{layer}/{lane}/{filename} or /{layer}/{lane} (deletes entire lane).'),
 }, async ({ path }) => {
   try {
-    const skillErr = await checkProjectSkills(getState().projectId);
-    if (skillErr) return err(new Error(skillErr));
-    const anchorErr = await checkAnchors(parseLayer(path));
-    if (anchorErr) return err(new Error(anchorErr));
     const clean = path.replace(/^\/+|\/+$/g, '');
     const result = await api('DELETE', `/api/fs/${clean}`);
     return ok({ ...result, project: getCurrentProjectContext() });
@@ -2338,8 +2347,6 @@ tool('batch', 'Batch operations on the ACTIVE PROJECT. Response includes "projec
       if (op.to) layers.add(parseLayer(op.to));
     }
     for (const layer of layers) {
-      const anchorErr = await checkAnchors(layer);
-      if (anchorErr) return err(new Error(anchorErr));
     }
 
     // Resolve file_path → base64 for write operations before sending to server
@@ -2429,8 +2436,6 @@ tool('asset', 'Manage supporting files (CSS, JS, images, fonts) in the ACTIVE PR
     const projectId = getState().projectId;
     if (!projectId) throw new Error('No active project. Call project(action="open") first.');
     if (action === 'upload') {
-      const skillErr = await checkProjectSkills(projectId);
-      if (skillErr) return err(new Error(skillErr));
       const { asset_path, file_path, content, base64: rawBase64, content_type, frame_id } = args;
       if (!asset_path) throw new Error('asset_path is required for action=upload');
       if (asset_path.includes('..')) throw new Error('asset_path must not contain ".."');
@@ -2460,8 +2465,6 @@ tool('asset', 'Manage supporting files (CSS, JS, images, fonts) in the ACTIVE PR
       return ok(await api('GET', `/api/projects/${projectId}/assets${query}`));
     }
     if (action === 'rm') {
-      const skillErr = await checkProjectSkills(projectId);
-      if (skillErr) return err(new Error(skillErr));
       const { asset_path } = args;
       if (!asset_path) throw new Error('asset_path is required for action=rm');
       if (asset_path.includes('..')) throw new Error('asset_path must not contain ".."');
@@ -2487,8 +2490,6 @@ tool('shape', 'Create a flowchart shape on the surface. Shapes are lightweight t
   layoutIgnore: z.boolean().optional().describe('Exclude this shape from auto-layout. Use for annotations, labels, or manually positioned elements.'),
 }, async ({ text, shape, layer, lane, color, fill, textColor, group, width, height, layoutIgnore }) => {
   try {
-    const skillErr = await checkProjectSkills(getState().projectId);
-    if (skillErr) return err(new Error(skillErr));
     const body = { text, shape };
     if (layer) body.layer = layer;
     if (lane) body.lane = lane;
@@ -2513,8 +2514,6 @@ tool('group', 'Create a group (swim lane / region) on the surface. Groups are la
   order: z.number().optional().describe('Sort order for group positioning (lower = first). Default: 0'),
 }, async ({ label, color, fill, layer, lane, order }) => {
   try {
-    const skillErr = await checkProjectSkills(getState().projectId);
-    if (skillErr) return err(new Error(skillErr));
     const body = { label };
     if (color) body.color = color;
     if (fill) body.fill = fill;
@@ -2537,8 +2536,6 @@ tool('connector', 'Create or remove connectors (arrows) between frames on the su
   connectorId: z.string().optional().describe('[disconnect] connector ID to delete directly'),
 }, async (args) => {
   try {
-    const skillErr = await checkProjectSkills(getState().projectId);
-    if (skillErr) return err(new Error(skillErr));
     const { action } = args;
     if (action === 'connect') {
       const { source, target, label, type = 'arrow-forward', color } = args;
@@ -2580,8 +2577,6 @@ tool('layout', 'Auto-arrange frames using graph layout algorithm. Positions conn
   groups: z.boolean().optional().default(false).describe('Enable group clustering. When true, shapes assigned to a group (via the group param) are clustered together, and group frames are resized to enclose their members.'),
 }, async ({ direction, groups }) => {
   try {
-    const skillErr = await checkProjectSkills(getState().projectId);
-    if (skillErr) return err(new Error(skillErr));
     const body = { direction };
     if (groups) body.groups = true;
     const result = await api('POST', '/api/layout', body);
@@ -2624,6 +2619,7 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
         const qs = params.toString();
         const endpoint = query ? '/api/skills/search' : '/api/skills';
         const result = await api('GET', `${endpoint}${qs ? '?' + qs : ''}`);
+        markSearched(getSessionState().gates, 'skill');
         const cap = Math.min(Math.max(1, limit || 25), 100);
         if (Array.isArray(result?.skills)) {
           if (result.skills.length > cap) {
@@ -2679,6 +2675,8 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
         return ok(await api('GET', `/api/orgs/${orgId}/skills`));
       }
       case 'add': {
+        const g2 = g2Block(getSessionState().gates);
+        if (g2) return err(new Error(g2));
         const { name, description, content, tags, triggerPatterns } = args;
         if (!name || !description || !content) throw new Error('name, description, content required for action=add');
         const body = { name, description, content };
@@ -2707,8 +2705,15 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
         const { skillId } = args;
         if (!skillId) throw new Error('skillId required for action=attach');
         if (!getState().projectId) throw new Error('No active project. Call project(action="open") first.');
+        // Cap (G4): keep attached skills + anchors within the per-project budget so
+        // the auto-inject set always fits — reject the attach if it would overflow.
+        try {
+          const used = await getProjectPrimingSize(getState().projectId);
+          let addSize = 0;
+          try { const full = await api('GET', `/api/skills/${skillId}`); addSize = (full?.content || '').length; } catch { /* unknown size */ }
+          if (wouldExceedBudget(used, addSize)) return err(new Error(budgetError(used, addSize, 'this skill')));
+        } catch { /* size check is best-effort */ }
         const result = await api('POST', `/api/projects/${getState().projectId}/skills`, { skillId });
-        invalidateProjectSkillsCache(getState().projectId);
         return ok(result);
       }
       case 'detach': {
@@ -2716,7 +2721,6 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
         if (!skillId) throw new Error('skillId required for action=detach');
         if (!getState().projectId) throw new Error('No active project. Call project(action="open") first.');
         const result = await api('DELETE', `/api/projects/${getState().projectId}/skills/${skillId}`);
-        invalidateProjectSkillsCache(getState().projectId);
         return ok(result);
       }
       case 'favorite': {
@@ -2911,6 +2915,7 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
         if (!searchQuery) throw new Error('query required for action=search');
         const result = await api('GET', `/api/wiki/search?q=${encodeURIComponent(searchQuery)}&limit=${searchLimit}`);
         const hits = (result.hits || []).map(h => ({ path: h.path, title: h.title, url: wikiBrowserUrl(h.path) }));
+        markSearched(getSessionState().gates, 'wiki');
         return ok({ hits });
       }
 
@@ -2989,10 +2994,6 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
         const { path, excalidraw_data, mermaid, width, height, color } = args;
         if (!path) throw new Error('path required for action=write_excalidraw');
         if (excalidraw_data != null && mermaid) throw new Error('Provide only one of excalidraw_data or mermaid');
-        const skillErr = await checkProjectSkills(getState().projectId);
-        if (skillErr) return err(new Error(skillErr));
-        const anchorErr = await checkAnchors(parseLayer(path));
-        if (anchorErr) return err(new Error(anchorErr));
         const parts = path.replace(/^\/+/, '').split('/');
         if (parts.length !== 3) throw new Error('Path must be /{layer}/{lane}/{filename}');
         const filename = parts[2].toLowerCase().endsWith('.excalidraw') ? parts[2] : parts[2] + '.excalidraw';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.7.26",
+  "version": "1.8.1",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [
@@ -9,6 +9,8 @@
     "server/lib/umami.mjs",
     "src/shared/",
     "agent-instructions/",
+    "plugin/skills/",
+    "plugin/commands/",
     "install-mcp.sh"
   ],
   "bin": {
@@ -28,9 +30,9 @@
     "import:legacy": "tsx scripts/import-legacy.mts",
     "test": "vitest run",
     "test:watch": "vitest",
-    "version": "node scripts/sync-versions.mjs && git add plugin/.claude-plugin/plugin.json .claude-plugin/marketplace.json",
+    "version": "node scripts/sync-versions.mjs && git add plugin/.claude-plugin/plugin.json .claude-plugin/marketplace.json web-plugin/.claude-plugin/plugin.json web-plugin/.claude-plugin/marketplace.json",
     "version:check": "node scripts/sync-versions.mjs",
-    "postpublish": "bash scripts/sync-plugin.sh \"chore: sync plugin to v$npm_package_version\"",
+    "postpublish": "bash scripts/sync-plugin.sh \"chore: sync plugin to v$npm_package_version\" && bash scripts/sync-web-plugin.sh \"chore: sync web-plugin to v$npm_package_version\"",
     "deploy:check:google": "node scripts/check-google-drive-deploy.mjs",
     "build:excalidraw": "node scripts/build-excalidraw-editor.mjs",
     "prepublishOnly": "node scripts/check-npm-package.mjs"

package/plugin/commands/create-project.md

@@ -0,0 +1,23 @@
+---
+description: Start a new project — or a reusable template — with proper search of knowledge, skills, and templates first
+argument-hint: <project name and what you want to do>
+---
+
+Spin up a project on the surface, or generalize one into a reusable template. Goal: $ARGUMENTS
+
+First ask: **a new project, or a reusable template?** (This command does both.)
+
+Search before creating (also satisfies the gates):
+1. `wiki(action="search")` for relevant knowledge. [G1]
+2. `skill(action="search")` for procedures that should be attached.
+3. `template(action="list")` for an existing template to fork. [G3 — also enforced on `project(action="create")`.]
+
+Then:
+- If a fitting template exists → `project(action="create", templateSlug=...)` to fork it; otherwise create fresh and define the layers.
+- `project(action="open")` the new project.
+- `frame(action="write")` a real brief at the earliest layer (goal, audience, constraints — 6-12 lines, not a placeholder).
+- `frame(action="anchor")` the brief so downstream work surfaces it.
+- Attach the relevant skills you found with `skill(action="attach")`.
+- `focus` the brief so the user watches it land.
+
+For a **template**: build the layer structure + anchored guidance, then note how to fork it next time. Don't speculatively fill downstream frames — wait for direction.

package/plugin/commands/create-skill.md

@@ -0,0 +1,18 @@
+---
+description: Capture a repeatable procedure as an org skill — with proper knowledge and prior-art search
+argument-hint: <what the procedure is for>
+---
+
+Turn a repeatable way of working into a Drafted skill so every future agent in the org follows it. Procedure: $ARGUMENTS
+
+Do the searches first (they also satisfy the gates):
+1. `wiki(action="search")` for relevant org knowledge the procedure should reference. [G1]
+2. `skill(action="search")` for prior art — an existing skill to improve instead of duplicating. [G2 — also enforced on `skill(action="add")`.] If a close match exists, prefer `/drafted:improve-skill`.
+
+Then define a PROPER procedure, not a vague note:
+- a clear trigger ("when to use this"),
+- ordered, concrete steps,
+- success criteria / what "done right" looks like,
+- written in the second person so any agent can follow it directly. Keep it sharp (~40 lines).
+
+Show the draft to the user with a proposed `name` (Title Case), one-line `description`, `tags` (3-5), and `triggerPatterns`. After approval, `skill(action="add")`. Confirm with the slug and note it will auto-surface on matching tasks.

package/plugin/commands/extract.md

@@ -0,0 +1,16 @@
+---
+description: Deposit what this session produced into the harness — knowledge, a skill, and/or a template
+argument-hint: <optional: what to capture>
+---
+
+Session-end deposit. Harvest what's durable from this conversation back into the harness so the next session starts smarter. Focus: $ARGUMENTS
+
+Review the session, then **present the user options for which store(s) to deposit into** — don't auto-decide. Offer any that apply:
+
+- **Knowledge → wiki** — durable facts, decisions, or findings worth keeping. Search first (`wiki(action="search")`) to avoid fragmenting, then `wiki(action="write")`.
+- **Procedure → skill** — a repeatable way of working that emerged. Follow `/drafted:create-skill`.
+- **Template → surface** — a reusable project structure that emerged. `template(action="create")` from the current project.
+
+Show the user the candidate deposits per store, let them pick which to keep, then write the chosen ones with their approval. Confirm what landed where.
+
+One command, all three stores — because at session end the human shouldn't have to remember which store is which.

package/plugin/commands/improve-project-harness.md

@@ -0,0 +1,16 @@
+---
+description: Turn corrections you made in a project into enforced gates (anchors, attached skills, layer rules)
+argument-hint: <optional: the correction to enforce>
+---
+
+When the user had to correct the work in this project, codify the correction so future work is compelled to comply. This is the nurture → enforce bridge. Correction: $ARGUMENTS
+
+1. Identify the recurring correction(s) or standing rule from this session.
+2. Choose the right Drafted-side gate per correction (each counts toward the project's context budget):
+   - **Project anchor** — a brief, constraint, or style guide that must be in context project-wide: `frame(action="write")` it, then `frame(action="anchor")`. [G5]
+   - **Attached skill** — a procedure that must be loaded before work: `/drafted:create-skill` (or `skill(action="search")` for an existing one), then `skill(action="attach")`. [G4]
+   - **Layer rule** — a standing instruction for one stage: set that layer's rules via `project(action="update", layers=...)`. [G6]
+3. Propose which mechanism for each correction, confirm with the user, then apply.
+4. Confirm what is now enforced — the next session in this project will be gated on it automatically.
+
+Keep within the project's context budget — if a deposit would exceed it, tighten existing gates instead of piling on.

package/plugin/commands/improve-skill.md

@@ -0,0 +1,14 @@
+---
+description: Fix a skill you noticed is inefficient, wrong, or missing a step
+argument-hint: <which skill, and what's off>
+---
+
+Improve an existing org skill when it underperformed in practice. Skill / issue: $ARGUMENTS
+
+1. `skill(action="search")` then `skill(action="load")` the skill in question — read it fully.
+2. Pinpoint the inefficiency: a missing step, a wrong instruction, an ambiguous trigger, or a step that wastes effort.
+3. Propose the specific edit to the user — show before/after of the changed steps.
+4. After approval, `skill(action="update")` (the version bumps automatically).
+5. Confirm what changed so the next agent benefits.
+
+Skills are the org's stable processes — every fix compounds across everyone who uses them.

package/plugin/commands/improve-wiki.md

@@ -0,0 +1,14 @@
+---
+description: Fix the wiki — reconcile stale, wrong, fragmented, or contradictory knowledge
+argument-hint: <what's wrong, or the topic to clean up>
+---
+
+Improve the org wiki when knowledge has drifted. Issue/topic: $ARGUMENTS
+
+1. `wiki(action="search")` (3-5 paraphrased queries) and `wiki(action="read")` the affected pages — don't trust titles, open them.
+2. Diagnose: duplicate pages, a stale fact, a contradiction, or knowledge fragmented across pages.
+3. Propose the fix to the user: consolidate duplicates, correct the fact, reconcile the contradiction, or re-link fragments.
+4. Apply with `wiki(action="edit")` (hashline) or `wiki(action="mv")` (which rewrites inbound links). Check `wiki(action="links")` before moving or deleting.
+5. `wiki(action="log")` what changed.
+
+Leave the wiki more coherent than you found it — fewer, sharper, better-linked pages.

package/plugin/commands/ingest.md

@@ -0,0 +1,20 @@
+---
+description: Bring knowledge into the wiki — from a research output, existing documents, or by interrogating you
+argument-hint: <optional: what to ingest, or a source>
+---
+
+Feed durable knowledge into the org wiki. Source/intent: $ARGUMENTS
+
+First decide WHAT to ingest. If it's obvious from the conversation (a research run just finished, or the user named a source), use that. Otherwise ask which of these three modes fits:
+
+1. **A research producible** — the output of a research run (a provider-native `/deep-research` or similar). Structure it into wiki pages.
+2. **Existing documents** — the user points at local / remote / connected folders. Scour them (spawn sub-agents if there are many) for relevant material, shortlist, confirm, then ingest the right ones. Folder scour needs file access (desktop / Cowork); on web, use connected sources.
+3. **Interrogate the user** (grill-me) — when the knowledge is in their head. Interview relentlessly, walking ONE branch of the decision tree at a time and proposing your recommended answer at each step, until you reach shared understanding. Then structure what you captured.
+
+Then deposit:
+- `wiki(action="search")` first (3-5 paraphrased queries) so you don't fragment existing pages.
+- Propose the page set to the user before writing.
+- Write with `wiki(action="write")`, or `wiki(action="source-register")` + `wiki(action="bulk-write")` for a batch. Cross-link related pages.
+- `wiki(action="log")` a one-line entry for the ingest.
+
+The wiki is the org's durable knowledge — write for the next agent and teammate, not just this session.

package/plugin/commands/onboard-drafted.md

@@ -0,0 +1,17 @@
+---
+description: First-run setup — orient to Drafted and bootstrap the harness (wiki, skills, first project)
+argument-hint: <optional: what you want to start working on>
+---
+
+Onboard the user to Drafted — a producibles harness that compounds across three primitives: knowledge (the wiki), procedures (skills), and the project surface. Goal/context: $ARGUMENTS
+
+This is the over-arching prime command: orient, then seed all three stores so every later session starts smart.
+
+1. **Orient** — in 3-4 lines explain the loop: you *prime* from the harness (the system makes you search the wiki, and auto-loads the project's attached skills, anchors, and layer rules before you work), you *build*, then you *compound* (deposit what you learned). The more it's used, the less searching and the more stable the work.
+2. **Confirm the org** — call `get_org`. Confirm the active organization is the one to build the harness in. If unsure, ask.
+3. **Seed knowledge** — run the `/drafted:ingest` flow: help the user point at existing business materials (folders, docs, past research) or interrogate them for tacit knowledge, and land durable pages in the wiki.
+4. **Seed procedures** — from those materials and the conversation, surface 1-3 candidate SOPs. For the most valuable, run the `/drafted:create-skill` flow.
+5. **Seed the surface** — run the `/drafted:create-project` flow for the user's immediate piece of work (or a reusable template).
+6. Close by showing what now exists (wiki pages, skills, project) and restate the one-line loop: prime → build → compound.
+
+Keep it guided and conversational — one step at a time, confirming before each deposit. Don't dump everything at once.

package/plugin/skills/drafted/SKILL.md

@@ -0,0 +1,84 @@
+---
+name: drafted
+description: Use the Drafted producibles harness — a compounding workspace that uplifts any AI across three primitives: knowledge (the org wiki), procedures (skills), and the project surface (frames on a shared real-time canvas). Prime from the harness before working, build durable artifacts as frames instead of burying output in chat, and deposit what you learned back so the next session starts smarter. When Google Drive is connected, prefer Google Workspace frames for docs, sheets, and slides.
+---
+
+# Drafted — a producibles harness that compounds
+
+Drafted makes any AI more effective by giving it a memory and a workspace that get better with use. It has three primitives that layer:
+
+- **Knowledge — the org wiki.** Durable facts, decisions, conventions. *More knowledge = less searching.*
+- **Procedures — skills.** Reusable SOPs the org has encoded. *Better skills = more stable process.*
+- **Surface — projects.** Reviewable work as frames on a shared zoomable canvas the user watches live at `https://drafted.live`. *Reusable projects + anchors = velocity with accuracy.*
+
+The point is the **compounding loop**: you don't produce in a vacuum, you draw on what the org already knows and leave it richer each pass.
+
+## The loop — prime → build → compound
+
+- **Prime (session start).** Pull accumulated value in. The system *enforces* this: you must search the wiki before working, and a project's attached skills, anchored frames, and layer rules are auto-loaded when you open it. Don't fight the gates — they make you start smart.
+- **Build (the work).** Produce artifacts as frames on the surface.
+- **Compound (session end / when you notice something).** Deposit learning back: capture knowledge, distill or fix a skill, harden the project. This is *your* responsibility — the system can't force it, so do it.
+
+## Mental model
+
+```
+Organization
+└── Project (a bounded piece of work, e.g. "Q4 strategy memo")
+    └── Layer (a stage of thinking, e.g. research → drafts → final)
+        └── Lane (a group of related frames, e.g. one competitor per lane)
+            └── Frame (an HTML / markdown / image file)
+```
+
+**Layers are stages** — they depend on the project's template. `project(action="create")` returns the active layers; always check rather than assume. **Frames have addresses** like `/layer/lane/filename`; the canvas auto-arranges them by layer (vertical) and lane (horizontal).
+
+## The gates you'll encounter (and how to satisfy them)
+
+These reset every session. A gate that blocks you tells you exactly what to call next — do it, don't work around it.
+
+- **G1 — wiki search before work.** Before you read or edit anything, `wiki(action="search")` for relevant org knowledge.
+- **G2 — prior-art before a new skill.** `skill(action="add")` requires a `skill(action="search")` first.
+- **G3 — prior-art before a new project.** `project(action="create")` requires wiki + skill + `template(action="list")` searches first.
+- **G4 — attached skills** are auto-injected when you open a project. Follow them — they're how the org does this work.
+- **G5 — the project's anchored frames** are auto-injected on open. They are required reading (briefs, constraints, style guides).
+- **G6 — a layer's rules** are surfaced when you work in that layer. Honor them.
+
+## The commands (when to reach for each)
+
+These bookend the loop. Prime/feed at the start, deposit at the end.
+
+- `/drafted:onboard-drafted` — first run: orient + bootstrap the harness (seed wiki, starter skills, first project).
+- `/drafted:ingest` — bring knowledge into the wiki (a research output, existing documents, or by interrogating the user).
+- `/drafted:create-skill` — capture a repeatable procedure (with knowledge + prior-art search).
+- `/drafted:create-project` — start a project or a reusable template (with knowledge/skill/template search).
+- `/drafted:improve-wiki` — fix stale / wrong / fragmented knowledge.
+- `/drafted:improve-skill` — fix a skill that underperformed.
+- `/drafted:improve-project-harness` — turn corrections into enforced gates (anchors / attached skills / layer rules).
+- `/drafted:extract` — session-end: deposit knowledge, a skill, and/or a template (the user picks which).
+
+## Tool surface (action-based)
+
+`project(list|open|create|update|move)` · `frame(read|write|edit|anchor|mv|search|…)` · `ls` · `skill(search|load|list|add|update|attach|…)` · `wiki(search|read|write|edit|mv|links|log|…)` · `template(list|create|fork|…)` · `focus` · `get_org` · `asset` · `layer`.
+
+## Sign in
+
+If a tool returns an auth error: on a desktop/CLI agent run the `auth(action="login")` tool (it prints a one-time URL; the user opens it). On the web/Cowork connector, authorization happens via the connector's OAuth — ask the user to re-authorize the Drafted connector in their settings, then retry.
+
+## Working on the surface
+
+- **Always `project(action="open")` first.** Every read/write operates on the active project. Use `project(action="list")` to find one. Every response includes a `project` field — verify it matches your intent before writing.
+- **Default to the surface for substantive artifacts.** When asked to draft, write, plan, analyze, compare, design, document, summarize, report, spec, model, or make a deck/table, create or update frames instead of leaving the durable result only in chat. One visible frame per artifact or section.
+- **Prefer Google Workspace when Drive is connected.** Call `get_org`; if it reports `googleDrive.connected: true`, use `frame(action="write", googleType="google-doc"|"google-sheet"|"google-slide", …)` for docs, sheets, and decks; populate immediately with the native write actions.
+- **Read before editing.** `frame(action="edit")` uses hashline addressing — every line in a `frame(action="read")` response gets a 4-char hash; pass it to edit for surgical changes.
+- **`focus` after writing** so the user watches your work land on their surface.
+
+## Quality conventions
+
+- **Match format to layer intent.** Research/strategy/copy are usually markdown; visual work (wireframes, designs, dashboards) is HTML.
+- **Respect the template's conventions.** Read a `design-system` layer before `/designs/`; read an `audience` layer before `/copy/`.
+- **Wireframes are low-fidelity** (grayscale, placeholders); reserve color and real content for the designs/final layer.
+- **Choose dimensions to fit content** — `autoSize: true` for HTML, or explicit `width`/`height`.
+- **Don't re-read unchanged frames** you already have this conversation.
+
+## Surface URL recognition
+
+Any URL containing `/f/{uuid}` is a Drafted frame link. Use `frame(action="read", path=URL)` to get its content and `focus(target=URL)` to pan the canvas to it. Never `WebFetch` Drafted URLs — the MCP tools authenticate properly.

package/src/shared/gate-budget.mjs

@@ -0,0 +1,30 @@
+// Single source of truth for the per-project auto-inject context budget.
+// Shared by the MCP gate logic (mcp/gates.mjs) and the server-side deposit caps
+// (server/lib/project-skill-routes.mjs) so web-remote, local-stdio, and raw-API
+// callers all enforce the same limit. ~24k chars ≈ 6k tokens.
+export const PROJECT_CONTEXT_BUDGET_CHARS = 24000;
+
+function gateItemChars(it) {
+  if (it && typeof it === 'object') {
+    if (it.content != null) return String(it.content).length;
+    if (typeof it.chars === 'number') return it.chars;
+  }
+  if (typeof it === 'string') return it.length;
+  if (typeof it === 'number') return it;
+  return 0;
+}
+
+// Greedily include items whose sizes fit the budget (in priority order); defer the
+// rest. Shared by the server-side project-open priming assembly and the MCP gate
+// fallback so both produce identical auto-inject sets.
+export function selectWithinBudget(items, budget = PROJECT_CONTEXT_BUDGET_CHARS, sizeOf = gateItemChars) {
+  const included = [];
+  const deferred = [];
+  let used = 0;
+  for (const it of items || []) {
+    const size = sizeOf(it);
+    if (used + size <= budget) { included.push(it); used += size; }
+    else { deferred.push(it); }
+  }
+  return { included, deferred, used, budget };
+}