drafted 1.11.11 → 1.11.12

package/cli/drafted.mjs

@@ -23,7 +23,12 @@ const __dirname = dirname(__filename);
 const DEFAULT_STATE_DIR = join(homedir(), '.drafted');
 const DEFAULT_PROJECTS_FILE = join(DEFAULT_STATE_DIR, 'projects.json');
 const DEFAULT_PID_FILE = join(DEFAULT_STATE_DIR, 'server.pid');
-const DEFAULT_AUTH_FILE = join(DEFAULT_STATE_DIR, 'auth.json');
+// Honor DRAFTED_AUTH_FILE so the CLI reads the SAME credential file the MCP does.
+// install-mcp.sh's --local mode points the MCP at auth.local.json via this env var;
+// without honoring it here the CLI would read auth.json while the MCP used a
+// different file, and the two would disagree about who is signed in (DRAFT-32).
+const DEFAULT_AUTH_FILE = process.env.DRAFTED_AUTH_FILE || join(DEFAULT_STATE_DIR, 'auth.json');
+const DEFAULT_CONFIG_FILE = join(DEFAULT_STATE_DIR, 'config.json');
 const DEFAULT_PORT = 3477;
 const PACKAGE_VERSION = (() => {
   try {
@@ -133,11 +138,37 @@ function isServerRunning() {
   }
 }
 
-// Helper: Get server URL (supports DRAFTED_SERVER env var or --server flag)
+// Helper: Read the install's server URL from ~/.drafted/config.json. This is the
+// SAME file the MCP server reads (written by install-mcp.sh), so the CLI and MCP
+// resolve to the same deployment.
+function readConfigServer() {
+  try {
+    if (existsSync(DEFAULT_CONFIG_FILE)) {
+      const cfg = JSON.parse(readFileSync(DEFAULT_CONFIG_FILE, 'utf8'));
+      return cfg.server || cfg.publicUrl || null;
+    }
+  } catch { /* ignore unreadable/corrupt config */ }
+  return null;
+}
+
+// Helper: Get server URL.
+// Precedence mirrors the MCP so a CLI invocation transparently targets the SAME
+// server the MCP (and the stored session) use — fixing DRAFT-32, where a CLI
+// holding a valid cloud session defaulted to localhost and got "Unauthenticated":
+//   1. DRAFTED_SERVER env / --server flag (explicit override; --server sets the env var)
+//   2. the auth file's `server` field — where the stored session is actually valid
+//   3. ~/.drafted/config.json (written by install-mcp.sh; the file the MCP reads)
+//   4. localhost (no cloud install configured)
+// (2) is preferred over (3) because the session cookie is only valid on the
+// server it was minted for; sending it anywhere else just yields a 401.
 function getServerUrl() {
   if (process.env.DRAFTED_SERVER) {
     return process.env.DRAFTED_SERVER.replace(/\/$/, '');
   }
+  const fromAuth = readAuth()?.server;
+  if (fromAuth) return String(fromAuth).replace(/\/$/, '');
+  const fromConfig = readConfigServer();
+  if (fromConfig) return String(fromConfig).replace(/\/$/, '');
   return `http://localhost:${process.env.DRAFTED_PORT || DEFAULT_PORT}`;
 }
 
@@ -252,7 +283,15 @@ async function readApiGet(command, apiPath, org) {
   }
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
-    const msg = data.error || `HTTP ${res.status}`;
+    let msg = data.error || `HTTP ${res.status}`;
+    // A valid session now targets the server it was minted for (see getServerUrl),
+    // so a 401/403 here means the credential is genuinely missing/expired — surface
+    // an actionable next step instead of the bare server "Unauthenticated" string.
+    if (res.status === 401 || res.status === 403) {
+      msg = `Not authenticated for ${serverUrl} — your Drafted session is missing or expired. `
+        + `Run \`drafted login\` to sign in. `
+        + `The CLI and MCP share ${DEFAULT_AUTH_FILE}, so signing in once works for both.`;
+    }
     jsonOut(false, command, msg);
     console.error(`❌ ${msg}`);
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.11",
+  "version": "1.11.12",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [