drafted 1.11.10 → 1.11.11

package/cli/drafted.mjs

@@ -234,14 +234,17 @@ function withQuery(base, params) {
 }
 
 // GET a Drafted API path with the stored session and return parsed JSON.
-// Strictly read-only: callers only ever issue GETs through this seam. On any
-// failure it emits a structured error (for --json) and exits non-zero.
-async function readApiGet(command, apiPath) {
+// Strictly read-only: callers only ever issue GETs through this seam. An
+// optional --org override is forwarded as the X-Drafted-Org header (the server
+// validates it against the caller's memberships). On any failure it emits a
+// structured error (for --json) and exits non-zero.
+async function readApiGet(command, apiPath, org) {
   requireLogin();
   const serverUrl = getServerUrl();
+  const headers = org ? { 'X-Drafted-Org': org } : {};
   let res;
   try {
-    res = await authFetch(`${serverUrl}${apiPath}`);
+    res = await authFetch(`${serverUrl}${apiPath}`, { headers });
   } catch (err) {
     jsonOut(false, command, `Could not reach server at ${serverUrl}: ${err.message}`);
     console.error(`❌ Could not reach server at ${serverUrl}: ${err.message}`);
@@ -1145,10 +1148,9 @@ program
 //
 // Project scoping: --project <id> selects the project (passed through as a query
 // param). When omitted, the server resolves the caller's active project. Org is
-// the logged-in session's active org — identical to `add`. (Cross-org reads
-// require switching org first; a per-request --org override is a deliberate
-// follow-up, not added here to avoid implying access the /api/fs/ routes don't
-// yet scope.)
+// the logged-in session's active org unless --org <id|name> is given, which the
+// server validates against the caller's memberships and scopes per-request via
+// the X-Drafted-Org header — without mutating the shared session's active org.
 
 // Command: ls (alias: list) — list layers / lanes / frames
 program
@@ -1156,6 +1158,7 @@ program
   .alias('list')
   .description('List layers, lanes, or frames in a project (read-only)')
   .option('--project <id>', 'Target project ID (defaults to your active project)')
+  .option('--org <org>', 'Resolve against this org (id or name); scopes per-request without switching the session')
   .option('--recursive', 'Recurse into subdirectories (forces summary mode)')
   .option('--summary', 'Include size, updatedAt, and title for frames')
   .option('--pattern <glob>', 'Filter frame filenames (e.g. "*.html")')
@@ -1163,7 +1166,7 @@ program
     const params = { path: path || '/', projectId: options.project, pattern: options.pattern };
     if (options.recursive) { params.recursive = 'true'; params.summary = 'true'; }
     else if (options.summary) params.summary = 'true';
-    const data = await readApiGet('ls', withQuery('/api/fs/', params));
+    const data = await readApiGet('ls', withQuery('/api/fs/', params), options.org);
     jsonOut(true, 'ls', data);
     printLs(data);
   });
@@ -1174,6 +1177,7 @@ program
   .aliases(['get', 'cat'])
   .description("Read a frame's content (HTML/text/markdown), or binary metadata, by path / frame URL / ID (read-only)")
   .option('--project <id>', 'Target project ID (defaults to your active project)')
+  .option('--org <org>', 'Resolve against this org (id or name); scopes per-request without switching the session')
   .option('--lines <range>', 'Line range to read, e.g. "1-40" or "20"')
   .action(async (pathOrId, options) => {
     let apiPath;
@@ -1184,7 +1188,7 @@ program
       console.error(`❌ ${err.message}`);
       process.exit(1);
     }
-    const data = await readApiGet('read', apiPath);
+    const data = await readApiGet('read', apiPath, options.org);
     jsonOut(true, 'read', data);
     if (data.type === 'binary') {
       console.log(`# ${data.path} (binary)`);
@@ -1206,10 +1210,11 @@ assetCmd
   .command('list')
   .description('List supporting assets (CSS/JS/images/fonts) in a project')
   .requiredOption('--project <id>', 'Target project ID')
+  .option('--org <org>', 'Resolve against this org (id or name); scopes per-request without switching the session')
   .option('--frame <id>', 'Only assets associated with this frame ID')
   .action(async (options) => {
     const apiPath = withQuery(`/api/projects/${encodeURIComponent(options.project)}/assets`, { frameId: options.frame });
-    const data = await readApiGet('asset-list', apiPath);
+    const data = await readApiGet('asset-list', apiPath, options.org);
     jsonOut(true, 'asset-list', data);
     const assets = data.assets || [];
     if (assets.length === 0) { console.log('No assets'); return; }
@@ -1223,8 +1228,9 @@ assetCmd
   .command('get <asset_path>')
   .description("Show a single asset's metadata (path, type, size, frame). Metadata only — asset bytes are not served over the API.")
   .requiredOption('--project <id>', 'Target project ID')
+  .option('--org <org>', 'Resolve against this org (id or name); scopes per-request without switching the session')
   .action(async (assetPath, options) => {
-    const data = await readApiGet('asset-get', `/api/projects/${encodeURIComponent(options.project)}/assets`);
+    const data = await readApiGet('asset-get', `/api/projects/${encodeURIComponent(options.project)}/assets`, options.org);
     const wanted = assetPath.replace(/^\/+/, '');
     const asset = (data.assets || []).find(a => a.path === assetPath || a.path === wanted);
     if (!asset) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.10",
+  "version": "1.11.11",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [