drafted 1.11.14 → 1.11.15

package/mcp/server.mjs

@@ -1230,7 +1230,13 @@ async function consumePendingDeviceCode() {
   return false;
 }
 
-tool('auth', 'Sign in to Drafted. `action=get_link` returns a verification URL immediately (use for SSH/headless/tmux where a browser may not open) and starts background polling; after the user opens the link, later Drafted tool calls also auto-consume the approved login. `action=login` opens a browser when needed and explicitly waits/polls for approval. If get_link was called first, login reuses that pending code instead of opening a new browser.', {
+// Device-flow sign-in is stdio-only. Web/Cowork connectors authenticate via
+// OAuth at the transport layer (the hosted /mcp handler injects a Drafted
+// session per request), so advertising a device-flow auth tool there is
+// meaningless and disruptive — it returns spurious sign-in URLs and, on login,
+// spawns a server-side browser-open and blocks polling until timeout. Register
+// it only on stdio.
+if (!isRemote) tool('auth', 'Sign in to Drafted. `action=get_link` returns a verification URL immediately (use for SSH/headless/tmux where a browser may not open) and starts background polling; after the user opens the link, later Drafted tool calls also auto-consume the approved login. `action=login` opens a browser when needed and explicitly waits/polls for approval. If get_link was called first, login reuses that pending code instead of opening a new browser.', {
   action: z.enum(['get_link', 'login']).describe('Operation to perform.'),
 }, async ({ action }) => {
   try {
@@ -1242,7 +1248,11 @@ tool('auth', 'Sign in to Drafted. `action=get_link` returns a verification URL i
       return ok(data.verificationUrl);
     }
     if (action === 'login') {
-      const existing = getBootstrapSessionId();
+      // Prefer the active request session (injected by runWithRequestState on
+      // remote, or cloneSession on stdio) over the on-disk bootstrap session, so
+      // an already-authenticated caller short-circuits to already_authenticated
+      // instead of starting a needless device flow.
+      const existing = getState().sessionId || getBootstrapSessionId();
       if (existing) {
         try {
           const res = await fetch(`${getServerUrl()}/auth/me`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.14",
+  "version": "1.11.15",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [