drafted 1.11.14 → 1.11.16

package/mcp/server.mjs

@@ -1230,7 +1230,13 @@ async function consumePendingDeviceCode() {
   return false;
 }
 
-tool('auth', 'Sign in to Drafted. `action=get_link` returns a verification URL immediately (use for SSH/headless/tmux where a browser may not open) and starts background polling; after the user opens the link, later Drafted tool calls also auto-consume the approved login. `action=login` opens a browser when needed and explicitly waits/polls for approval. If get_link was called first, login reuses that pending code instead of opening a new browser.', {
+// Device-flow sign-in is stdio-only. Web/Cowork connectors authenticate via
+// OAuth at the transport layer (the hosted /mcp handler injects a Drafted
+// session per request), so advertising a device-flow auth tool there is
+// meaningless and disruptive — it returns spurious sign-in URLs and, on login,
+// spawns a server-side browser-open and blocks polling until timeout. Register
+// it only on stdio.
+if (!isRemote) tool('auth', 'Sign in to Drafted. `action=get_link` returns a verification URL immediately (use for SSH/headless/tmux where a browser may not open) and starts background polling; after the user opens the link, later Drafted tool calls also auto-consume the approved login. `action=login` opens a browser when needed and explicitly waits/polls for approval. If get_link was called first, login reuses that pending code instead of opening a new browser.', {
   action: z.enum(['get_link', 'login']).describe('Operation to perform.'),
 }, async ({ action }) => {
   try {
@@ -1242,7 +1248,11 @@ tool('auth', 'Sign in to Drafted. `action=get_link` returns a verification URL i
       return ok(data.verificationUrl);
     }
     if (action === 'login') {
-      const existing = getBootstrapSessionId();
+      // Prefer the active request session (injected by runWithRequestState on
+      // remote, or cloneSession on stdio) over the on-disk bootstrap session, so
+      // an already-authenticated caller short-circuits to already_authenticated
+      // instead of starting a needless device flow.
+      const existing = getState().sessionId || getBootstrapSessionId();
       if (existing) {
         try {
           const res = await fetch(`${getServerUrl()}/auth/me`, {
@@ -2812,7 +2822,6 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
   tags: z.array(z.string()).optional().describe('[search] filter by tags; [add|update] tag list'),
   scope: z.enum(['all', 'org', 'global']).optional().describe('[search|list] library scope (default: all for search; when provided to list, lists the library instead of project/org attachments)'),
   limit: z.number().optional().describe('[search|list] max results per page (default 25, max 100)'),
-  offset: z.number().optional().describe('[search|list] skip N results for pagination (default 0). Response reports totalAvailable/returned/truncated.'),
   compact: z.boolean().optional().describe('[search|list] return only {slug,name,tags} per skill instead of full summaries — for browsing large catalogs within token budget'),
   skill: z.string().optional().describe('[load|history] skill ID (UUID) or slug'),
   version: z.number().optional().describe('[history] fetch this version number\'s full snapshot (content included); omit for the reverse-chron version list'),
@@ -2823,6 +2832,8 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
   content: z.string().optional().describe('[add|update] root SKILL.md content; [update_file] file content'),
   triggerPatterns: z.array(z.string()).optional().describe('[add|update] patterns that suggest this skill'),
   path: z.string().optional().describe('[read_file|update_file] relative path inside skill directory (e.g. "examples/react.md")'),
+  offset: z.number().optional().describe('[search|list] skip N results for pagination; [read_file] start reading at this byte offset (default 0) — for large files (e.g. a >90KB app-frame bundle) read in chunks using the returned nextOffset until truncated=false'),
+  maxBytes: z.number().optional().describe('[read_file] return at most this many bytes from offset (default: whole remaining file). Response reports totalSize/offset/truncated/nextOffset.'),
   org: z.string().optional().describe('[fork|push|update] resolve/fork into this Drafted org (id or name); scopes the request without switching the session'),
   setup: z.array(z.string()).optional().describe('[add|update] setup command(s) (in order) run on materialize to build a source-only skill, e.g. ["npm ci","npm run build"]'),
   files: z.array(z.object({ path: z.string(), content: z.string() })).optional().describe('[push] source files to push (path + UTF-8 content); server strips artifacts + enforces caps'),
@@ -3010,9 +3021,13 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
         return ok(await api('DELETE', `/api/skills/favorites/${skillId}`));
       }
       case 'read_file': {
-        const { skillId, path } = args;
+        const { skillId, path, offset, maxBytes } = args;
         if (!skillId || !path) throw new Error('skillId and path required for action=read_file');
-        return ok(await api('GET', `/api/skills/${skillId}/files/${path}`));
+        const params = new URLSearchParams();
+        if (offset != null) params.set('offset', String(offset));
+        if (maxBytes != null) params.set('maxBytes', String(maxBytes));
+        const qs = params.toString();
+        return ok(await api('GET', `/api/skills/${skillId}/files/${path}${qs ? `?${qs}` : ''}`));
       }
       case 'update_file': {
         const { skillId, path, content } = args;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.14",
+  "version": "1.11.16",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [