drafted 1.11.11 → 1.11.13

package/agent-instructions/global.md

@@ -29,6 +29,8 @@ Skill rules:
 - Search skills before starting repeatable work: skill(action="search") or skill(action="list").
 - Load and follow relevant skills with skill(action="load"). Read supporting skill files when needed.
 - When the user asks to record, distill, create, save, install, or update a skill/procedure/SOP/checklist/method/protocol/playbook, create or update a Drafted skill for the org with skill tools.
+- Every skill has a portable part — its method, SKILL.md, and any script source — and that part always belongs in Drafted, not only in a local repo. When you build a runnable skill, push the source to Drafted (skill action="push", or skill action="add" for prose) and declare how to rebuild it in the skill's `setup:` frontmatter (e.g. ["npm ci"]) so any machine or agent can regenerate it. Do not leave a reusable skill authored only as local files when Drafted is connected.
+- Machine-specific build output (node_modules, downloaded browsers, compiled binaries) is never portable: build it into a `.skillinstall/` directory inside the skill. Drafted always strips `.skillinstall/` from a pushed bundle and skill push auto-gitignores it, so the rebuildable bundle stays local while the method and recipe stay in Drafted.
 - Improve skills when you find a better checklist, standard, or operating method.
 
 Project/producible rules:

package/cli/drafted.mjs

@@ -23,7 +23,12 @@ const __dirname = dirname(__filename);
 const DEFAULT_STATE_DIR = join(homedir(), '.drafted');
 const DEFAULT_PROJECTS_FILE = join(DEFAULT_STATE_DIR, 'projects.json');
 const DEFAULT_PID_FILE = join(DEFAULT_STATE_DIR, 'server.pid');
-const DEFAULT_AUTH_FILE = join(DEFAULT_STATE_DIR, 'auth.json');
+// Honor DRAFTED_AUTH_FILE so the CLI reads the SAME credential file the MCP does.
+// install-mcp.sh's --local mode points the MCP at auth.local.json via this env var;
+// without honoring it here the CLI would read auth.json while the MCP used a
+// different file, and the two would disagree about who is signed in (DRAFT-32).
+const DEFAULT_AUTH_FILE = process.env.DRAFTED_AUTH_FILE || join(DEFAULT_STATE_DIR, 'auth.json');
+const DEFAULT_CONFIG_FILE = join(DEFAULT_STATE_DIR, 'config.json');
 const DEFAULT_PORT = 3477;
 const PACKAGE_VERSION = (() => {
   try {
@@ -133,11 +138,37 @@ function isServerRunning() {
   }
 }
 
-// Helper: Get server URL (supports DRAFTED_SERVER env var or --server flag)
+// Helper: Read the install's server URL from ~/.drafted/config.json. This is the
+// SAME file the MCP server reads (written by install-mcp.sh), so the CLI and MCP
+// resolve to the same deployment.
+function readConfigServer() {
+  try {
+    if (existsSync(DEFAULT_CONFIG_FILE)) {
+      const cfg = JSON.parse(readFileSync(DEFAULT_CONFIG_FILE, 'utf8'));
+      return cfg.server || cfg.publicUrl || null;
+    }
+  } catch { /* ignore unreadable/corrupt config */ }
+  return null;
+}
+
+// Helper: Get server URL.
+// Precedence mirrors the MCP so a CLI invocation transparently targets the SAME
+// server the MCP (and the stored session) use — fixing DRAFT-32, where a CLI
+// holding a valid cloud session defaulted to localhost and got "Unauthenticated":
+//   1. DRAFTED_SERVER env / --server flag (explicit override; --server sets the env var)
+//   2. the auth file's `server` field — where the stored session is actually valid
+//   3. ~/.drafted/config.json (written by install-mcp.sh; the file the MCP reads)
+//   4. localhost (no cloud install configured)
+// (2) is preferred over (3) because the session cookie is only valid on the
+// server it was minted for; sending it anywhere else just yields a 401.
 function getServerUrl() {
   if (process.env.DRAFTED_SERVER) {
     return process.env.DRAFTED_SERVER.replace(/\/$/, '');
   }
+  const fromAuth = readAuth()?.server;
+  if (fromAuth) return String(fromAuth).replace(/\/$/, '');
+  const fromConfig = readConfigServer();
+  if (fromConfig) return String(fromConfig).replace(/\/$/, '');
   return `http://localhost:${process.env.DRAFTED_PORT || DEFAULT_PORT}`;
 }
 
@@ -252,7 +283,15 @@ async function readApiGet(command, apiPath, org) {
   }
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
-    const msg = data.error || `HTTP ${res.status}`;
+    let msg = data.error || `HTTP ${res.status}`;
+    // A valid session now targets the server it was minted for (see getServerUrl),
+    // so a 401/403 here means the credential is genuinely missing/expired — surface
+    // an actionable next step instead of the bare server "Unauthenticated" string.
+    if (res.status === 401 || res.status === 403) {
+      msg = `Not authenticated for ${serverUrl} — your Drafted session is missing or expired. `
+        + `Run \`drafted login\` to sign in. `
+        + `The CLI and MCP share ${DEFAULT_AUTH_FILE}, so signing in once works for both.`;
+    }
     jsonOut(false, command, msg);
     console.error(`❌ ${msg}`);
     process.exit(1);
@@ -1789,7 +1828,7 @@ skillCmd
 function collectSkillTree(dir) {
   const root = resolve(dir);
   if (!existsSync(root) || !statSync(root).isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const SKIP_DIRS = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform']);
+  const SKIP_DIRS = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform', '.skillinstall']);
   let ignore = () => false;
   const ignPath = join(root, '.skillignore');
   if (existsSync(ignPath)) {
@@ -1815,9 +1854,25 @@ function collectSkillTree(dir) {
   return out;
 }
 
+// Ensure the pushed source tree's .gitignore excludes the rebuildable bundle dir,
+// so a skill's machine-specific build output (built into .skillinstall/ by its
+// `setup:` recipe) can never be committed. The server already strips .skillinstall/
+// from the bundle (skill-ingest DENY_DIRS) — this keeps the author's git clean too.
+// Idempotent; returns true only when it adds the entry.
+function ensureSkillInstallIgnored(dir) {
+  try {
+    const gi = join(dir, '.gitignore');
+    const existing = existsSync(gi) ? readFileSync(gi, 'utf8') : '';
+    if (existing.split(/\r?\n/).some((l) => l.trim().replace(/\/$/, '') === '.skillinstall')) return false;
+    const body = existing && !existing.endsWith('\n') ? existing + '\n' : existing;
+    writeFileSync(gi, body + '.skillinstall/\n');
+    return true;
+  } catch { return false; }
+}
+
 skillCmd
   .command('push')
-  .description('Push a local source tree into a skill (bulk ingest; server strips artifacts + enforces caps)')
+  .description('Push a local source tree into a Drafted skill (bulk ingest). Stores the portable bits — SKILL.md, scripts, and the setup: recipe; build output is stripped server-side. Build machine-specific output into .skillinstall/ (auto-gitignored, always stripped) and declare its rebuild in setup:.')
   .option('--id <id>', 'skill id')
   .option('--slug <slug>', 'skill slug (resolved to id)')
   .requiredOption('--dir <dir>', 'local source tree to push')
@@ -1839,8 +1894,9 @@ skillCmd
     });
     const data = await res.json().catch(() => ({}));
     if (!res.ok) { emitSkillResult(opts.format, { status: 'error', id, error: data.error || `HTTP ${res.status}` }); process.exit(1); }
-    if (opts.format === 'json') console.log(JSON.stringify({ status: 'ok', id, hash: data.hash, count: data.count, stripped: data.stripped, files: data.files }));
-    else console.log(`ok\t${id}\t${data.hash}\tpushed ${data.count}${data.stripped ? `, stripped ${data.stripped}` : ''}`);
+    const gitignored = ensureSkillInstallIgnored(opts.dir);
+    if (opts.format === 'json') console.log(JSON.stringify({ status: 'ok', id, hash: data.hash, count: data.count, stripped: data.stripped, gitignored, files: data.files }));
+    else console.log(`ok\t${id}\t${data.hash}\tpushed ${data.count}${data.stripped ? `, stripped ${data.stripped}` : ''}${gitignored ? ', gitignored .skillinstall/' : ''}`);
   });
 
 program.parse();

package/install-mcp.sh

@@ -443,6 +443,8 @@ Skill rules:
 - Search skills before starting repeatable work: skill(action="search") or skill(action="list").
 - Load and follow relevant skills with skill(action="load"). Read supporting skill files when needed.
 - When the user asks to record, distill, create, save, install, or update a skill/procedure/SOP/checklist/method/protocol/playbook, create or update a Drafted skill for the org with skill tools.
+- Every skill has a portable part — its method, SKILL.md, and any script source — and that part always belongs in Drafted, not only in a local repo. When you build a runnable skill, push the source to Drafted (skill action="push", or skill action="add" for prose) and declare how to rebuild it in the skill's `setup:` frontmatter (e.g. ["npm ci"]) so any machine or agent can regenerate it. Do not leave a reusable skill authored only as local files when Drafted is connected.
+- Machine-specific build output (node_modules, downloaded browsers, compiled binaries) is never portable: build it into a `.skillinstall/` directory inside the skill. Drafted always strips `.skillinstall/` from a pushed bundle and skill push auto-gitignores it, so the rebuildable bundle stays local while the method and recipe stay in Drafted.
 - Improve skills when you find a better checklist, standard, or operating method.
 
 Project/producible rules:

package/mcp/server.mjs

@@ -2751,7 +2751,7 @@ tool('layout', 'Auto-arrange frames using graph layout algorithm. Positions conn
 function collectSkillTreeForPush(dir) {
   const root = resolve(dir);
   if (!existsSync(root) || !statSync(root).isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const SKIP = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform']);
+  const SKIP = new Set(['node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build', '.next', 'target', 'coverage', '.cache', '.turbo', '.gradle', 'Pods', '.terraform', '.skillinstall']);
   const NUL = String.fromCharCode(0);
   let ignore = () => false;
   const ign = join(root, '.skillignore');
@@ -2778,7 +2778,22 @@ function collectSkillTreeForPush(dir) {
   return out;
 }
 
-tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/guidelines agents can load and follow. Dispatch by `action`: search/load/list for discovery; history for a skill\'s version git-log; add/update/remove for org skills; fork/push for source-only skills; attach/detach for project binding; favorite/unfavorite for personal pins; read_file/update_file for supporting files inside a skill directory.', {
+// Ensure a pushed source tree's .gitignore excludes the rebuildable bundle dir, so
+// a skill's machine-specific build output (built into .skillinstall/ by its `setup:`
+// recipe) can never be committed. The server also strips .skillinstall/ from the
+// bundle (skill-ingest DENY_DIRS); this keeps the author's git clean. Idempotent.
+function ensureSkillInstallIgnored(dir) {
+  try {
+    const gi = join(dir, '.gitignore');
+    const existing = existsSync(gi) ? readFileSync(gi, 'utf8') : '';
+    if (existing.split(/\r?\n/).some((l) => l.trim().replace(/\/$/, '') === '.skillinstall')) return false;
+    const body = existing && !existing.endsWith('\n') ? existing + '\n' : existing;
+    writeFileSync(gi, body + '.skillinstall/\n');
+    return true;
+  } catch { return false; }
+}
+
+tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/guidelines agents can load and follow. When you build a reusable skill, author it HERE — add for prose, push to ingest a local source tree — so its method and setup: recipe live in Drafted and any machine or agent can reuse it; keep only machine-specific build output local in .skillinstall/ (always stripped on push). Dispatch by `action`: search/load/list for discovery; history for a skill\'s version git-log; add/update/remove for org skills; fork/push for source-only skills; attach/detach for project binding; favorite/unfavorite for personal pins; read_file/update_file for supporting files inside a skill directory.', {
   action: z.enum([
     'search', 'load', 'list', 'history',
     'add', 'update', 'remove',
@@ -2805,7 +2820,7 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
   org: z.string().optional().describe('[fork|push|update] resolve/fork into this Drafted org (id or name); scopes the request without switching the session'),
   setup: z.array(z.string()).optional().describe('[add|update] setup command(s) (in order) run on materialize to build a source-only skill, e.g. ["npm ci","npm run build"]'),
   files: z.array(z.object({ path: z.string(), content: z.string() })).optional().describe('[push] source files to push (path + UTF-8 content); server strips artifacts + enforces caps'),
-  dir: z.string().optional().describe('[push] local directory to push instead of files[]; walked locally (heavy dirs + .skillignore pre-filtered), server re-enforces'),
+  dir: z.string().optional().describe('[push] local directory to push instead of files[]; walked locally (heavy dirs, .skillinstall/, and .skillignore pre-filtered), server re-enforces. On push the dir\'s .gitignore is auto-updated to exclude .skillinstall/ (the rebuildable bundle).'),
   deleteMissing: z.boolean().optional().describe('[push] remove stored files not present in the pushed set'),
 }, async (args) => {
   try {
@@ -2952,7 +2967,9 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
         let fileList = files;
         if (!fileList && dir) fileList = collectSkillTreeForPush(dir);
         if (!Array.isArray(fileList) || fileList.length === 0) throw new Error('files[] (non-empty) or dir required for action=push');
-        return ok(await api('POST', `/api/skills/${id}/files/bulk`, { files: fileList, deleteMissing: !!deleteMissing }, extra));
+        const pushed = await api('POST', `/api/skills/${id}/files/bulk`, { files: fileList, deleteMissing: !!deleteMissing }, extra);
+        if (dir) { try { if (ensureSkillInstallIgnored(dir)) pushed.gitignored = '.skillinstall/'; } catch { /* best-effort */ } }
+        return ok(pushed);
       }
       case 'attach': {
         const { skillId } = args;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.11",
+  "version": "1.11.13",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [