drafted 1.11.35 → 1.11.37

package/mcp/server.mjs

@@ -19,7 +19,7 @@ import { z } from 'zod';
 import { registerAppResource, RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/server';
 import WebSocket from 'ws';
 import { LAYERS } from '../src/shared/constants.mjs';
-import { emptyExcalidrawScene, excalidrawSceneFromMermaid, stringifyExcalidrawScene } from '../src/shared/excalidraw.mjs';
+import { emptyExcalidrawScene, stringifyExcalidrawScene } from '../src/shared/excalidraw.mjs';
 import { createGateState, markSearched, g1Block, g2Block, g3Block, selectWithinBudget, wouldExceedBudget, budgetError, formatWikiIndex, PROJECT_CONTEXT_BUDGET_CHARS } from './gates.mjs';
 import { loadPersistedProject, savePersistedProject } from './active-project-store.mjs';
 
@@ -701,12 +701,12 @@ function schedulePendingAuthPoll(delayMs = 2000) {
 }
 
 // Cookie for normal tool operations. Deliberately uses ONLY this instance's
-// per-process session (getState().sessionId) and never the shared root login in
-// ~/.drafted/auth.json. The root is a *credential for minting child sessions*
-// (see cloneSession): every agent process on the machine reads the same root, so
-// operating on it directly is exactly what let one agent's get_org switch move
-// every other agent's active org. ensureSession() guarantees a per-instance
-// session before any operation runs.
+// MCP requests carry a cloned child session (getState().sessionId) minted from the
+// shared root login in ~/.drafted/auth.json. NOTE: org isolation is per-REQUEST via
+// the X-Drafted-Org header (server: effectiveOrgId), NOT via the session — the old
+// "clone per process so one agent's org switch doesn't move another's" model is
+// DEPRECATED. The clone remains only to give the agent a stable surface identity
+// (one playful tab name across reconnects/restarts — see cloneSession).
 function getAuthHeaders() {
   const sid = getState().sessionId;
   const headers = {};
@@ -719,22 +719,21 @@ function getAuthHeaders() {
   return headers;
 }
 
-// Mint a fresh per-instance child session from the shared root login and bind it
-// to this process. The root session id (getBootstrapSessionId) is shared by every
-// agent on this machine via ~/.drafted/auth.json; the clone gives THIS process its
-// own server-side session so its active org/project stay isolated from other
-// agents. Returns true once a per-instance session is set.
+// Mint (or reuse) a child session from the shared root login. The server dedups by
+// (user, agentKey), so the SAME session comes back across reconnects/restarts → one
+// stable surface + one playful tab name. Org isolation is per-request (X-Drafted-Org),
+// NOT per-session, so reusing one child session across processes is safe.
 async function cloneSession() {
   if (getState().sessionId) return true;
   const bootstrapId = getBootstrapSessionId();
   if (!bootstrapId) return false;
 
   try {
-    // A named agent (DRAFTED_AGENT_NAME) gets a STABLE child session: the server
-    // returns the same session for the same (user, agentKey) across reconnects, so a
-    // restarted agent reconnects its existing named session instead of churning a new
-    // one. Anonymous clients send no key and keep a fresh-per-process session.
-    const agentKey = (process.env.DRAFTED_AGENT_NAME || '').trim();
+    // Named agents key on DRAFTED_AGENT_NAME; anonymous agents key on the root login
+    // id (stable per machine) so they ALSO keep one stable session/name across restarts
+    // instead of churning a fresh session every process. (Org is per-request, so a
+    // shared child session does NOT cause cross-agent org clobbering.)
+    const agentKey = (process.env.DRAFTED_AGENT_NAME || '').trim() || bootstrapId;
     const res = await fetch(`${getServerUrl()}/auth/session/clone`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Cookie: `gc_session=${bootstrapId}` },
@@ -1316,8 +1315,8 @@ async function consumePendingDeviceCode() {
     const data = await res.json();
     if (data.status === 'approved' && data.sessionId) {
       // data.sessionId is the shared ROOT login. Persist it as the machine-level
-      // credential, then mint our OWN per-instance child session from it (mirrors
-      // the `auth login` tool) so this process never operates on the shared root.
+      // credential, then mint a child session from it (mirrors the `auth login` tool)
+      // so the agent gets a stable surface identity (see cloneSession).
       persistAuthSession(data);
       clearPendingDeviceCode();
       getState().sessionId = null;
@@ -2047,7 +2046,6 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
   content: z.string().optional().describe('[write] HTML/markdown/text for Drafted inline frames. [write_doc_content|append_doc_content] native Google Doc body text. Do not use action=write content to populate Google Doc/Slide frames.'),
   excalidraw_data: z.any().optional().describe('[write_excalidraw] Excalidraw scene JSON object or JSON string. Defaults to an empty scene.'),
   state: z.any().optional().describe('[set_state] App-frame state object (JSON) to persist for a deployed windowType:"app" frame — e.g. {specText:"..."} for the AS/NZS electrical app. The canvas hydrates the app from this on load (the host posts a "hydrate" message with it when the frame mounts), so you can deploy a generic app frame once and drive it with data afterwards. Max 64KB. Frame must be an app frame.'),
-  mermaid: z.string().optional().describe('[write_excalidraw] Mermaid source to convert into an editable Excalidraw scene.'),
   file_path: z.string().optional().describe('[write] absolute path to a local file to upload. Mutually exclusive with content/base64/googleType.'),
   base64: z.string().optional().describe('[write] base64-encoded binary content. Mutually exclusive with content/file_path/googleType. Use with content_type when known.'),
   content_type: z.string().optional().describe('[write + base64] MIME type for base64 binary content, e.g. image/png, application/pdf. Defaults from the path extension or application/octet-stream.'),
@@ -2439,13 +2437,12 @@ tool('frame', 'Frame CRUD in the ACTIVE PROJECT. Dispatch by `action`: read (by
         });
       }
       case 'write_excalidraw': {
-        const { path, excalidraw_data, mermaid, width, height, color } = args;
+        const { path, excalidraw_data, width, height, color } = args;
         if (!path) throw new Error('path required for action=write_excalidraw');
-        if (excalidraw_data != null && mermaid) throw new Error('Provide only one of excalidraw_data or mermaid');
         const parts = path.replace(/^\/+/, '').split('/');
         if (parts.length !== 3) throw new Error('Path must be /{layer}/{lane}/{filename}');
         const filename = parts[2].toLowerCase().endsWith('.excalidraw') ? parts[2] : parts[2] + '.excalidraw';
-        const scene = mermaid ? await excalidrawSceneFromMermaid(mermaid) : (excalidraw_data ?? emptyExcalidrawScene());
+        const scene = excalidraw_data ?? emptyExcalidrawScene();
         const body = { content: stringifyExcalidrawScene(scene) };
         if (width) body.width = width;
         if (height) body.height = height;
@@ -3463,13 +3460,12 @@ tool('wiki', 'Per-org wiki. Markdown pages with paths as hierarchy. You and othe
       // `LINE+ID|content`). The server applies the ops via the same
       // hashline algorithm — no client-side re-hashing, no algorithm drift.
       case 'write_excalidraw': {
-        const { path, excalidraw_data, mermaid, width, height, color } = args;
+        const { path, excalidraw_data, width, height, color } = args;
         if (!path) throw new Error('path required for action=write_excalidraw');
-        if (excalidraw_data != null && mermaid) throw new Error('Provide only one of excalidraw_data or mermaid');
         const parts = path.replace(/^\/+/, '').split('/');
         if (parts.length !== 3) throw new Error('Path must be /{layer}/{lane}/{filename}');
         const filename = parts[2].toLowerCase().endsWith('.excalidraw') ? parts[2] : parts[2] + '.excalidraw';
-        const scene = mermaid ? await excalidrawSceneFromMermaid(mermaid) : (excalidraw_data ?? emptyExcalidrawScene());
+        const scene = excalidraw_data ?? emptyExcalidrawScene();
         const body = { content: stringifyExcalidrawScene(scene) };
         if (width) body.width = width;
         if (height) body.height = height;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.35",
+  "version": "1.11.37",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [
@@ -45,7 +45,6 @@
     "@clerk/express": "^2.1.4",
     "@clerk/mcp-tools": "^0.3.1",
     "@excalidraw/excalidraw": "^0.18.1",
-    "@excalidraw/mermaid-to-excalidraw": "^2.2.2",
     "@modelcontextprotocol/ext-apps": "^1.6.0",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "@sentry/browser": "^10.53.1",
@@ -59,7 +58,6 @@
     "esbuild": "^0.28.0",
     "exceljs": "^4.4.0",
     "express": "^4.18.2",
-    "jsdom": "^27.0.1",
     "jszip": "^3.10.1",
     "lucide": "^1.16.0",
     "mdast-util-from-markdown": "^2.0.3",

package/src/shared/excalidraw.mjs

@@ -38,64 +38,3 @@ export function normalizeExcalidrawScene(input) {
 export function stringifyExcalidrawScene(input) {
   return JSON.stringify(normalizeExcalidrawScene(input), null, 2);
 }
-
-function restoreMermaidDom(previous, dom) {
-  for (const [key, value] of Object.entries(previous)) {
-    if (value === undefined) {
-      try { delete globalThis[key]; } catch {}
-    } else if (key === 'navigator') {
-      Object.defineProperty(globalThis, 'navigator', { value, configurable: true });
-    } else {
-      globalThis[key] = value;
-    }
-  }
-  if (dom) dom.window.close();
-}
-
-export async function excalidrawSceneFromMermaid(mermaid) {
-  let dom;
-  const previous = {
-    window: globalThis.window,
-    document: globalThis.document,
-    DOMParser: globalThis.DOMParser,
-    XMLSerializer: globalThis.XMLSerializer,
-    Element: globalThis.Element,
-    SVGElement: globalThis.SVGElement,
-    navigator: globalThis.navigator,
-    CSSStyleSheet: globalThis.CSSStyleSheet,
-  };
-  try {
-    if (typeof document === 'undefined') {
-      const { JSDOM } = await import('jsdom');
-      dom = new JSDOM('<!doctype html><html><body></body></html>');
-      globalThis.window = dom.window;
-      globalThis.document = dom.window.document;
-      globalThis.DOMParser = dom.window.DOMParser;
-      globalThis.XMLSerializer = dom.window.XMLSerializer;
-      globalThis.Element = dom.window.Element;
-      globalThis.SVGElement = dom.window.SVGElement;
-      if (globalThis.SVGElement && !globalThis.SVGElement.prototype.getBBox) {
-        globalThis.SVGElement.prototype.getBBox = function () {
-          const text = this.textContent || '';
-          return { x: 0, y: 0, width: Math.max(24, text.length * 8), height: 20 };
-        };
-      }
-      Object.defineProperty(globalThis, 'navigator', { value: dom.window.navigator, configurable: true });
-      globalThis.CSSStyleSheet = class {
-        constructor() { this.cssRules = []; }
-        replaceSync() { this.cssRules = []; }
-        insertRule(rule) { this.cssRules.push({ cssText: rule }); }
-      };
-    }
-    const { parseMermaidToExcalidraw } = await import('@excalidraw/mermaid-to-excalidraw');
-    const result = await parseMermaidToExcalidraw(mermaid);
-    return {
-      ...emptyExcalidrawScene(),
-      elements: result.elements || [],
-      files: result.files || {},
-      appState: { viewBackgroundColor: '#ffffff' },
-    };
-  } finally {
-    if (dom) restoreMermaidDom(previous, dom);
-  }
-}