drafted 1.11.10 → 1.11.12

package/cli/drafted.mjs

@@ -23,7 +23,12 @@ const __dirname = dirname(__filename);
 const DEFAULT_STATE_DIR = join(homedir(), '.drafted');
 const DEFAULT_PROJECTS_FILE = join(DEFAULT_STATE_DIR, 'projects.json');
 const DEFAULT_PID_FILE = join(DEFAULT_STATE_DIR, 'server.pid');
-const DEFAULT_AUTH_FILE = join(DEFAULT_STATE_DIR, 'auth.json');
+// Honor DRAFTED_AUTH_FILE so the CLI reads the SAME credential file the MCP does.
+// install-mcp.sh's --local mode points the MCP at auth.local.json via this env var;
+// without honoring it here the CLI would read auth.json while the MCP used a
+// different file, and the two would disagree about who is signed in (DRAFT-32).
+const DEFAULT_AUTH_FILE = process.env.DRAFTED_AUTH_FILE || join(DEFAULT_STATE_DIR, 'auth.json');
+const DEFAULT_CONFIG_FILE = join(DEFAULT_STATE_DIR, 'config.json');
 const DEFAULT_PORT = 3477;
 const PACKAGE_VERSION = (() => {
   try {
@@ -133,11 +138,37 @@ function isServerRunning() {
   }
 }
 
-// Helper: Get server URL (supports DRAFTED_SERVER env var or --server flag)
+// Helper: Read the install's server URL from ~/.drafted/config.json. This is the
+// SAME file the MCP server reads (written by install-mcp.sh), so the CLI and MCP
+// resolve to the same deployment.
+function readConfigServer() {
+  try {
+    if (existsSync(DEFAULT_CONFIG_FILE)) {
+      const cfg = JSON.parse(readFileSync(DEFAULT_CONFIG_FILE, 'utf8'));
+      return cfg.server || cfg.publicUrl || null;
+    }
+  } catch { /* ignore unreadable/corrupt config */ }
+  return null;
+}
+
+// Helper: Get server URL.
+// Precedence mirrors the MCP so a CLI invocation transparently targets the SAME
+// server the MCP (and the stored session) use — fixing DRAFT-32, where a CLI
+// holding a valid cloud session defaulted to localhost and got "Unauthenticated":
+//   1. DRAFTED_SERVER env / --server flag (explicit override; --server sets the env var)
+//   2. the auth file's `server` field — where the stored session is actually valid
+//   3. ~/.drafted/config.json (written by install-mcp.sh; the file the MCP reads)
+//   4. localhost (no cloud install configured)
+// (2) is preferred over (3) because the session cookie is only valid on the
+// server it was minted for; sending it anywhere else just yields a 401.
 function getServerUrl() {
   if (process.env.DRAFTED_SERVER) {
     return process.env.DRAFTED_SERVER.replace(/\/$/, '');
   }
+  const fromAuth = readAuth()?.server;
+  if (fromAuth) return String(fromAuth).replace(/\/$/, '');
+  const fromConfig = readConfigServer();
+  if (fromConfig) return String(fromConfig).replace(/\/$/, '');
   return `http://localhost:${process.env.DRAFTED_PORT || DEFAULT_PORT}`;
 }
 
@@ -234,14 +265,17 @@ function withQuery(base, params) {
 }
 
 // GET a Drafted API path with the stored session and return parsed JSON.
-// Strictly read-only: callers only ever issue GETs through this seam. On any
-// failure it emits a structured error (for --json) and exits non-zero.
-async function readApiGet(command, apiPath) {
+// Strictly read-only: callers only ever issue GETs through this seam. An
+// optional --org override is forwarded as the X-Drafted-Org header (the server
+// validates it against the caller's memberships). On any failure it emits a
+// structured error (for --json) and exits non-zero.
+async function readApiGet(command, apiPath, org) {
   requireLogin();
   const serverUrl = getServerUrl();
+  const headers = org ? { 'X-Drafted-Org': org } : {};
   let res;
   try {
-    res = await authFetch(`${serverUrl}${apiPath}`);
+    res = await authFetch(`${serverUrl}${apiPath}`, { headers });
   } catch (err) {
     jsonOut(false, command, `Could not reach server at ${serverUrl}: ${err.message}`);
     console.error(`❌ Could not reach server at ${serverUrl}: ${err.message}`);
@@ -249,7 +283,15 @@ async function readApiGet(command, apiPath) {
   }
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
-    const msg = data.error || `HTTP ${res.status}`;
+    let msg = data.error || `HTTP ${res.status}`;
+    // A valid session now targets the server it was minted for (see getServerUrl),
+    // so a 401/403 here means the credential is genuinely missing/expired — surface
+    // an actionable next step instead of the bare server "Unauthenticated" string.
+    if (res.status === 401 || res.status === 403) {
+      msg = `Not authenticated for ${serverUrl} — your Drafted session is missing or expired. `
+        + `Run \`drafted login\` to sign in. `
+        + `The CLI and MCP share ${DEFAULT_AUTH_FILE}, so signing in once works for both.`;
+    }
     jsonOut(false, command, msg);
     console.error(`❌ ${msg}`);
     process.exit(1);
@@ -1145,10 +1187,9 @@ program
 //
 // Project scoping: --project <id> selects the project (passed through as a query
 // param). When omitted, the server resolves the caller's active project. Org is
-// the logged-in session's active org — identical to `add`. (Cross-org reads
-// require switching org first; a per-request --org override is a deliberate
-// follow-up, not added here to avoid implying access the /api/fs/ routes don't
-// yet scope.)
+// the logged-in session's active org unless --org <id|name> is given, which the
+// server validates against the caller's memberships and scopes per-request via
+// the X-Drafted-Org header — without mutating the shared session's active org.
 
 // Command: ls (alias: list) — list layers / lanes / frames
 program
@@ -1156,6 +1197,7 @@ program
   .alias('list')
   .description('List layers, lanes, or frames in a project (read-only)')
   .option('--project <id>', 'Target project ID (defaults to your active project)')
+  .option('--org <org>', 'Resolve against this org (id or name); scopes per-request without switching the session')
   .option('--recursive', 'Recurse into subdirectories (forces summary mode)')
   .option('--summary', 'Include size, updatedAt, and title for frames')
   .option('--pattern <glob>', 'Filter frame filenames (e.g. "*.html")')
@@ -1163,7 +1205,7 @@ program
     const params = { path: path || '/', projectId: options.project, pattern: options.pattern };
     if (options.recursive) { params.recursive = 'true'; params.summary = 'true'; }
     else if (options.summary) params.summary = 'true';
-    const data = await readApiGet('ls', withQuery('/api/fs/', params));
+    const data = await readApiGet('ls', withQuery('/api/fs/', params), options.org);
     jsonOut(true, 'ls', data);
     printLs(data);
   });
@@ -1174,6 +1216,7 @@ program
   .aliases(['get', 'cat'])
   .description("Read a frame's content (HTML/text/markdown), or binary metadata, by path / frame URL / ID (read-only)")
   .option('--project <id>', 'Target project ID (defaults to your active project)')
+  .option('--org <org>', 'Resolve against this org (id or name); scopes per-request without switching the session')
   .option('--lines <range>', 'Line range to read, e.g. "1-40" or "20"')
   .action(async (pathOrId, options) => {
     let apiPath;
@@ -1184,7 +1227,7 @@ program
       console.error(`❌ ${err.message}`);
       process.exit(1);
     }
-    const data = await readApiGet('read', apiPath);
+    const data = await readApiGet('read', apiPath, options.org);
     jsonOut(true, 'read', data);
     if (data.type === 'binary') {
       console.log(`# ${data.path} (binary)`);
@@ -1206,10 +1249,11 @@ assetCmd
   .command('list')
   .description('List supporting assets (CSS/JS/images/fonts) in a project')
   .requiredOption('--project <id>', 'Target project ID')
+  .option('--org <org>', 'Resolve against this org (id or name); scopes per-request without switching the session')
   .option('--frame <id>', 'Only assets associated with this frame ID')
   .action(async (options) => {
     const apiPath = withQuery(`/api/projects/${encodeURIComponent(options.project)}/assets`, { frameId: options.frame });
-    const data = await readApiGet('asset-list', apiPath);
+    const data = await readApiGet('asset-list', apiPath, options.org);
     jsonOut(true, 'asset-list', data);
     const assets = data.assets || [];
     if (assets.length === 0) { console.log('No assets'); return; }
@@ -1223,8 +1267,9 @@ assetCmd
   .command('get <asset_path>')
   .description("Show a single asset's metadata (path, type, size, frame). Metadata only — asset bytes are not served over the API.")
   .requiredOption('--project <id>', 'Target project ID')
+  .option('--org <org>', 'Resolve against this org (id or name); scopes per-request without switching the session')
   .action(async (assetPath, options) => {
-    const data = await readApiGet('asset-get', `/api/projects/${encodeURIComponent(options.project)}/assets`);
+    const data = await readApiGet('asset-get', `/api/projects/${encodeURIComponent(options.project)}/assets`, options.org);
     const wanted = assetPath.replace(/^\/+/, '');
     const asset = (data.assets || []).find(a => a.path === assetPath || a.path === wanted);
     if (!asset) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.10",
+  "version": "1.11.12",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [