drafted 1.11.13 → 1.11.15

package/cli/drafted.mjs

@@ -1899,4 +1899,132 @@ skillCmd
     else console.log(`ok\t${id}\t${data.hash}\tpushed ${data.count}${data.stripped ? `, stripped ${data.stripped}` : ''}${gitignored ? ', gitignored .skillinstall/' : ''}`);
   });
 
+// ── Collectors: management seam (parity with the MCP `collector` tool) ──
+// Collectors are checklist-driven intake surfaces. Management is behind the
+// agent allowlist (same gate as Minion) and scoped to the session's active org.
+function emitCollectorResult(format, obj) {
+  if (format === 'json') { console.log(JSON.stringify(obj)); return; }
+  console.log([obj.status, obj.id || '', obj.slug || '', obj.name || '', obj.error || ''].join('\t'));
+}
+
+async function collectorSetEnabled(id, enabled, format) {
+  requireLogin();
+  const server = getServerUrl().replace(/\/$/, '');
+  const res = await authFetch(`${server}/api/collectors/${encodeURIComponent(id)}`, {
+    method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ enabled }),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) { emitCollectorResult(format, { status: res.status === 404 ? 'not-found' : 'error', error: data.error || `HTTP ${res.status}` }); process.exit(1); }
+  const c = data.collector || {};
+  emitCollectorResult(format, { status: 'ok', id: c.id, slug: c.slug, name: c.name });
+}
+
+const collectorCmd = program.command('collector').description('Collector management (checklist-driven intake surfaces). Requires the agent allowlist.');
+
+collectorCmd
+  .command('list')
+  .description('List collectors (scoped to --project or your active project; all org collectors if neither)')
+  .option('--project <id>', 'project to scope to (defaults to your active project)')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    const pid = opts.project || getActiveProject()?.id;
+    const data = await readApiGet('collector:list', withQuery('/api/collectors', { projectId: pid }));
+    const rows = data.collectors || [];
+    if (opts.format === 'json') { console.log(JSON.stringify(rows)); return; }
+    for (const c of rows) console.log(`${c.id}\t${c.slug}\t${c.enabled ? 'enabled' : 'disabled'}\t${c.name}`);
+  });
+
+collectorCmd
+  .command('get <id>')
+  .description('Get a collector by id')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (id, opts) => {
+    const data = await readApiGet('collector:get', `/api/collectors/${encodeURIComponent(id)}`);
+    if (opts.format === 'json') { console.log(JSON.stringify(data.collector || data)); return; }
+    const c = data.collector || {};
+    console.log(`${c.id}\t${c.slug}\t${c.enabled ? 'enabled' : 'disabled'}\t${c.name}`);
+  });
+
+collectorCmd
+  .command('meta')
+  .description('Project layers/lanes/frames for building a collector target/output')
+  .option('--project <id>', 'project (defaults to your active project)')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    const pid = opts.project || getActiveProject()?.id;
+    if (!pid) { console.error('No active project. Pass --project <id> or run `drafted use <project>`.'); process.exit(1); }
+    const data = await readApiGet('collector:meta', withQuery('/api/collectors/meta', { projectId: pid }));
+    console.log(JSON.stringify(data));
+  });
+
+collectorCmd
+  .command('create')
+  .description('Create a collector from stdin JSON {name,description?,target,checklist,output,enabled?}')
+  .option('--project <id>', 'project to bind to (defaults to your active project)')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    requireLogin();
+    const pid = opts.project || getActiveProject()?.id;
+    if (!pid) { emitCollectorResult(opts.format, { status: 'error', error: 'no project — pass --project <id> or run `drafted use <project>`' }); process.exit(1); }
+    let p;
+    try { p = readStdinJSON(); } catch { console.error('invalid JSON on stdin'); process.exit(1); }
+    const server = getServerUrl().replace(/\/$/, '');
+    const res = await authFetch(`${server}/api/collectors`, {
+      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ projectId: pid, name: p.name, description: p.description, target: p.target, checklist: p.checklist, output: p.output, enabled: p.enabled }),
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) { emitCollectorResult(opts.format, { status: res.status === 403 ? 'forbidden' : 'error', error: data.error || `HTTP ${res.status}` }); process.exit(1); }
+    const c = data.collector || {};
+    emitCollectorResult(opts.format, { status: 'ok', id: c.id, slug: c.slug, name: c.name });
+  });
+
+collectorCmd
+  .command('update <id>')
+  .description('Update a collector from stdin JSON {name?,description?,target?,checklist?,output?,enabled?}')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (id, opts) => {
+    requireLogin();
+    let p;
+    try { p = readStdinJSON(); } catch { console.error('invalid JSON on stdin'); process.exit(1); }
+    const body = {};
+    for (const k of ['name', 'description', 'target', 'checklist', 'output', 'enabled']) {
+      if (p[k] !== undefined) body[k] = p[k];
+    }
+    if (Object.keys(body).length === 0) { emitCollectorResult(opts.format, { status: 'error', error: 'no fields to update' }); process.exit(1); }
+    const server = getServerUrl().replace(/\/$/, '');
+    const res = await authFetch(`${server}/api/collectors/${encodeURIComponent(id)}`, {
+      method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) { emitCollectorResult(opts.format, { status: res.status === 404 ? 'not-found' : 'error', error: data.error || `HTTP ${res.status}` }); process.exit(1); }
+    const c = data.collector || {};
+    emitCollectorResult(opts.format, { status: 'ok', id: c.id, slug: c.slug, name: c.name });
+  });
+
+collectorCmd
+  .command('enable <id>')
+  .description('Make a collector live')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action((id, opts) => collectorSetEnabled(id, true, opts.format));
+
+collectorCmd
+  .command('disable <id>')
+  .description('Take a collector offline')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action((id, opts) => collectorSetEnabled(id, false, opts.format));
+
+collectorCmd
+  .command('delete <id>')
+  .description('Delete a collector (past submissions are kept as history)')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (id, opts) => {
+    requireLogin();
+    const server = getServerUrl().replace(/\/$/, '');
+    const res = await authFetch(`${server}/api/collectors/${encodeURIComponent(id)}`, { method: 'DELETE' });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) { emitCollectorResult(opts.format, { status: res.status === 404 ? 'not-found' : 'error', error: data.error || `HTTP ${res.status}` }); process.exit(1); }
+    emitCollectorResult(opts.format, { status: 'ok', id: data.id || id });
+  });
+
 program.parse();

package/mcp/server.mjs

@@ -139,6 +139,7 @@ const REMOTE_JSON_STRING_PARAMS = {
   wiki: ['frontmatter', 'pages'],
   project: ['layers'],
   template: ['layers'],
+  collector: ['target', 'checklist', 'output'],
 };
 
 // Remove sentences that reference local-file params from a tool description,
@@ -242,6 +243,9 @@ const TOOL_ANNOTATIONS = {
   // Skills
   skill:               { title: 'Skills',              readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Manage the Drafted skill library: search, load, add, update, remove, attach/detach from projects, favorite, and edit skill files.' },
   wiki:                { title: 'Wiki',                readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Per-org wiki. Markdown pages with paths as hierarchy. Dispatch by `action`.' },
+
+  // Collectors — checklist-driven, Minion-run intake surfaces bound to a project
+  collector:           { title: 'Collectors',          readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Manage Collectors: checklist-driven intake surfaces that guide a consumer through a checklist (via a shareable /c/<slug> link) and then write a producible into the project. Dispatch by `action`: meta (discover layers/lanes/frames), list, get, create, update, enable, disable, delete. Requires the agent allowlist (same gate as Minion).' },
 };
 
 function isMutatingToolCall(name, args = {}) {
@@ -267,6 +271,8 @@ function isMutatingToolCall(name, args = {}) {
       return ['add', 'update', 'remove', 'attach', 'detach', 'favorite', 'unfavorite', 'update_file'].includes(action);
     case 'wiki':
       return ['log', 'write', 'edit', 'mv', 'rm', 'source-register', 'bulk-write'].includes(action);
+    case 'collector':
+      return ['create', 'update', 'enable', 'disable', 'delete'].includes(action);
     case 'rm':
     case 'shape':
     case 'group':
@@ -361,7 +367,7 @@ function tool(name, descOrSchema, schemaOrHandler, handler) {
           const v = args[0][k];
           if (typeof v === 'string' && v.trim()) {
             try { args[0][k] = JSON.parse(v); }
-            catch { return err(new Error(`Param "${k}" must be a JSON-encoded ${k === 'excalidraw_data' || k === 'frontmatter' ? 'object' : 'array'} string; JSON.parse failed.`)); }
+            catch { return err(new Error(`Param "${k}" must be a JSON-encoded ${['excalidraw_data', 'frontmatter', 'target', 'output'].includes(k) ? 'object' : 'array'} string; JSON.parse failed.`)); }
           }
         }
       }
@@ -1224,7 +1230,13 @@ async function consumePendingDeviceCode() {
   return false;
 }
 
-tool('auth', 'Sign in to Drafted. `action=get_link` returns a verification URL immediately (use for SSH/headless/tmux where a browser may not open) and starts background polling; after the user opens the link, later Drafted tool calls also auto-consume the approved login. `action=login` opens a browser when needed and explicitly waits/polls for approval. If get_link was called first, login reuses that pending code instead of opening a new browser.', {
+// Device-flow sign-in is stdio-only. Web/Cowork connectors authenticate via
+// OAuth at the transport layer (the hosted /mcp handler injects a Drafted
+// session per request), so advertising a device-flow auth tool there is
+// meaningless and disruptive — it returns spurious sign-in URLs and, on login,
+// spawns a server-side browser-open and blocks polling until timeout. Register
+// it only on stdio.
+if (!isRemote) tool('auth', 'Sign in to Drafted. `action=get_link` returns a verification URL immediately (use for SSH/headless/tmux where a browser may not open) and starts background polling; after the user opens the link, later Drafted tool calls also auto-consume the approved login. `action=login` opens a browser when needed and explicitly waits/polls for approval. If get_link was called first, login reuses that pending code instead of opening a new browser.', {
   action: z.enum(['get_link', 'login']).describe('Operation to perform.'),
 }, async ({ action }) => {
   try {
@@ -1236,7 +1248,11 @@ tool('auth', 'Sign in to Drafted. `action=get_link` returns a verification URL i
       return ok(data.verificationUrl);
     }
     if (action === 'login') {
-      const existing = getBootstrapSessionId();
+      // Prefer the active request session (injected by runWithRequestState on
+      // remote, or cloneSession on stdio) over the on-disk bootstrap session, so
+      // an already-authenticated caller short-circuits to already_authenticated
+      // instead of starting a needless device flow.
+      const existing = getState().sessionId || getBootstrapSessionId();
       if (existing) {
         try {
           const res = await fetch(`${getServerUrl()}/auth/me`, {
@@ -3423,6 +3439,129 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
   } catch (error) { return err(error); }
 });
 
+// ── Collectors ────────────────────────────────────────────────────
+
+function compactCollectorEntry(c) {
+  if (!c || typeof c !== 'object') return c;
+  return { id: c.id, slug: c.slug, name: c.name, enabled: c.enabled, projectId: c.projectId };
+}
+
+// Shape a {collectors:[...]} list with limit/offset pagination + optional compact
+// mode, mirroring shapeSkillCatalog so large lists stay within token budget.
+function shapeCollectorList(result, { limit, offset = 0, compact = false } = {}) {
+  if (!Array.isArray(result?.collectors)) return result;
+  const total = result.collectors.length;
+  const start = Math.max(0, Math.floor(Number(offset) || 0));
+  const cap = Math.min(Math.max(1, Math.floor(Number(limit) || 25)), 100);
+  const page = result.collectors.slice(start, start + cap);
+  result.totalAvailable = total;
+  result.offset = start;
+  result.returned = page.length;
+  result.truncated = start + page.length < total;
+  result.collectors = compact ? page.map(compactCollectorEntry) : page;
+  result.note = compact
+    ? 'Compact list: {id,slug,name,enabled,projectId} only. Use collector(action="get", id="<id>") for full config; limit/offset to page.'
+    : 'Collectors are scoped to the active project (all org collectors when no project is open). Use limit/offset to page; compact=true for a leaner list.';
+  return result;
+}
+
+// Friendlier message when the agent allowlist gate (requireAgentAccess) rejects.
+function collectorGateError(e) {
+  if (e?.status === 403 || e?.code === 'agent_disabled') {
+    return new Error('Collector management is not enabled for this org/account (agent allowlist). Ask an admin to add your org or email to DRAFTED_AGENT_ALLOWED_ORGS / DRAFTED_AGENT_ALLOWED_EMAILS.');
+  }
+  return e;
+}
+
+tool('collector', {
+  action: z.enum(['meta', 'list', 'get', 'create', 'update', 'enable', 'disable', 'delete']).describe('Operation to perform.'),
+  id: z.string().optional().describe('[get|update|enable|disable|delete] collector ID (UUID)'),
+  projectId: z.string().optional().describe('[create|meta] project to bind/scope to (defaults to the active project). Operates on the session’s active org — open the target project first via project(action="open"), or get_org(action="switch") to change org.'),
+  name: z.string().optional().describe('[create|update] collector name'),
+  description: z.string().optional().describe('[create|update] one-line description shown to the consumer'),
+  enabled: z.boolean().optional().describe('[create|update] whether the collector is live; a disabled collector 404s on its /c/<slug> link. enable/disable set this directly.'),
+  target: z.object({
+    type: z.enum(['new-record', 'layer', 'frame']).describe('what the run writes against'),
+    layer: z.string().optional(),
+    frameId: z.string().optional(),
+  }).optional().describe('[create|update] where the run writes: a new record, into a layer, or updating a specific frame'),
+  checklist: z.array(z.object({
+    id: z.string().describe('stable item id'),
+    label: z.string().describe('what the consumer is asked for'),
+    description: z.string().optional(),
+    evidence: z.enum(['text', 'file', 'photo', 'none']).optional().describe('evidence required (default none)'),
+    required: z.boolean().optional(),
+  })).optional().describe('[create|update] ordered checklist the Minion guides the consumer through'),
+  output: z.object({
+    mode: z.enum(['generate', 'update', 'annotate']).describe('how the producible is written'),
+    layer: z.string().optional(),
+    lane: z.string().optional(),
+    filenameTemplate: z.string().optional().describe('e.g. "<id>.md"'),
+    skillSlug: z.string().optional().describe('skill that shapes the produced frame'),
+    grouping: z.string().optional().describe('"lane" gives each submission its own lane'),
+  }).optional().describe('[create|update] where/how the producible lands'),
+  limit: z.number().optional().describe('[list] max results per page (default 25, max 100)'),
+  offset: z.number().optional().describe('[list] skip N results for pagination (default 0)'),
+  compact: z.boolean().optional().describe('[list] return only {id,slug,name,enabled,projectId} per collector'),
+}, async (args) => {
+  try {
+    const { action } = args;
+    switch (action) {
+      case 'meta': {
+        const active = getState().projectId;
+        const pid = active || args.projectId;
+        if (!pid) throw new Error('No active project. Call project(action="open") first, or pass projectId.');
+        // api() auto-appends the active project; add projectId explicitly only when none is active.
+        const path = active ? '/api/collectors/meta' : `/api/collectors/meta?projectId=${encodeURIComponent(pid)}`;
+        return ok(await api('GET', path));
+      }
+      case 'list': {
+        // api() auto-appends the active project as ?projectId — so this lists the
+        // active project's collectors, or all org collectors when none is open.
+        const result = await api('GET', '/api/collectors');
+        return ok(shapeCollectorList(result, { limit: args.limit, offset: args.offset, compact: args.compact }));
+      }
+      case 'get': {
+        if (!args.id) throw new Error('id is required for action=get');
+        return ok(await api('GET', `/api/collectors/${args.id}`));
+      }
+      case 'create': {
+        // projectId lives in the BODY (the POST route reads body, ignores the query).
+        const projectId = args.projectId || getState().projectId;
+        if (!projectId) throw new Error('No active project. Call project(action="open") first, or pass projectId.');
+        const { name, description, target, checklist, output, enabled } = args;
+        if (!name || !target || !Array.isArray(checklist) || !output) {
+          throw new Error('name, target, checklist[], and output are required for action=create');
+        }
+        const body = { projectId, name, target, checklist, output };
+        if (description !== undefined) body.description = description;
+        if (enabled !== undefined) body.enabled = enabled;
+        return ok(await api('POST', '/api/collectors', body));
+      }
+      case 'update': {
+        if (!args.id) throw new Error('id is required for action=update');
+        const body = {};
+        for (const k of ['name', 'description', 'target', 'checklist', 'output', 'enabled']) {
+          if (args[k] !== undefined) body[k] = args[k];
+        }
+        if (Object.keys(body).length === 0) throw new Error('At least one field is required for action=update');
+        return ok(await api('PATCH', `/api/collectors/${args.id}`, body));
+      }
+      case 'enable':
+      case 'disable': {
+        if (!args.id) throw new Error(`id is required for action=${action}`);
+        return ok(await api('PATCH', `/api/collectors/${args.id}`, { enabled: action === 'enable' }));
+      }
+      case 'delete': {
+        if (!args.id) throw new Error('id is required for action=delete');
+        return ok(await api('DELETE', `/api/collectors/${args.id}`));
+      }
+      default:
+        throw new Error(`Unknown collector action: ${action}`);
+    }
+  } catch (error) { return err(collectorGateError(error)); }
+});
+
 // ── Resource: canvas info ─────────────────────────────────────────
 
 server.resource('info', 'drafted://info', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.13",
+  "version": "1.11.15",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [