fix(mcp): compare the whole project file before saving an MCP edit to it

The guard against overwriting a closed project compared only
`project.updatedAt`. Two saves inside one millisecond share that stamp, and a
writer outside the app (a sync tool, a restored copy) may not change it, so an
MCP edit could still land on top of either. Compare the re-read document in
full instead.

Raised by CodeRabbit on #1040.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: 2 people

electron/mcp/openscreen-mcp-server.test.ts

@@ -2,7 +2,7 @@
 // ephemeral port, with an in-memory stand-in for the editor window and a real
 // DocumentService on a temp directory for the projects that are not open.
 
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -520,6 +520,31 @@ describe("projects other than the open one", () => {
 		expect(onDisk.project.title).toBe("Renamed");
 		expect(onDisk.timeline.trimRanges).toHaveLength(0);
 	});
+
+	it("does not save over a change that kept the file's updatedAt", async () => {
+		const saved = await projects.saveProject(fixtureDocument("proj_2"));
+		const file = path.join(dir, "projects", "proj_2.openscreen");
+		const getProject = projects.getProject.bind(projects);
+		let reads = 0;
+		projects.getProject = async (id) => {
+			const document = await getProject(id);
+			if (++reads === 1) {
+				// A writer outside the app (a sync tool, a restored copy): same stamp, new content.
+				const renamed = { ...saved, project: { ...saved.project, title: "Renamed" } };
+				writeFileSync(file, JSON.stringify(renamed));
+			}
+			return document;
+		};
+		const mcp = await connect(new FakeEditor());
+		const result = await mcp.callTool({
+			name: "addTrim",
+			arguments: { ...addTrimArgs, projectId: "proj_2" },
+		});
+		expect(result.isError).toBe(true);
+		const onDisk = await getProject("proj_2");
+		expect(onDisk.project.title).toBe("Renamed");
+		expect(onDisk.timeline.trimRanges).toHaveLength(0);
+	});
 });
 
 describe("the HTTP guard", () => {

electron/mcp/openscreen-mcp-server.ts

@@ -276,8 +276,11 @@ export function createToolRunner(deps: McpToolDeps) {
 			if (openProjectId(await deps.host.snapshot()) === projectId) {
 				return textResult(PROJECT_CHANGED_MESSAGE, true);
 			}
+			// The whole document, not just `updatedAt`: two saves inside one
+			// millisecond share a stamp, and a writer outside the app (a sync tool,
+			// a restored copy) may not touch it at all.
 			const onDisk = await deps.projects.getProject(projectId);
-			if (onDisk.project.updatedAt !== document.project.updatedAt) {
+			if (JSON.stringify(onDisk) !== JSON.stringify(document)) {
 				return textResult(PROJECT_CHANGED_MESSAGE, true);
 			}
 			await deps.projects.saveProject(execution.document);

technical-documentation/architecture/mcp-server.md

@@ -53,7 +53,7 @@ Only the webContents that registered on `ai-edition.mcp-host` is asked, and only
 Read with `DocumentService.getProject` (migrated and relinked, like any open) and, if the tool changed it, saved with `saveProject` — the same instance every other save in the app goes through, so its per-project write queue still holds. There is no revision to guard with, so right before the save two checks run, and either one refuses the edit with "NOT applied … re-read, then retry":
 
 1. **The editor has not opened it meanwhile.** The editor is asked for a snapshot again; if its project is now this one, the edit is left to it. The client's retry, with the same `projectId`, then goes through the editor.
-2. **Nothing else saved it meanwhile.** The file is re-read and its `project.updatedAt` must still be the one the tool ran against.
+2. **Nothing else changed it meanwhile.** The file is re-read and must still be, in full, the document the tool ran against. Comparing `project.updatedAt` alone is not enough: two saves inside one millisecond share a stamp, and a writer outside the app (a sync tool, a restored copy) may not touch it.
 
 An edit made this way is saved, but it is not on any undo stack: the editor never held it. It is in the project the next time it is opened.