drafted 1.11.6 → 1.11.8

package/install-mcp.sh

@@ -625,6 +625,8 @@ import AppKit
 
 @main
 struct DraftedUpdaterApp: App {
+  @NSApplicationDelegateAdaptor(AppDelegate.self) var appDelegate
+
   init() {
     Telemetry.report(event: "drafted_update_helper_started", updateHelperStatus: "running")
     Telemetry.report(event: "drafted_heartbeat", updateHelperStatus: "running")
@@ -632,6 +634,7 @@ struct DraftedUpdaterApp: App {
 
   var body: some Scene {
     MenuBarExtra {
+      Button("Check for Updates…") { Actions.checkForUpdate(userInitiated: true) }
       Button("Update Drafted") { Actions.updateDrafted() }
       Button("View Logs") { Actions.viewLogs() }
       Button("Open Drafted") { Actions.openDrafted() }
@@ -651,6 +654,24 @@ struct DraftedUpdaterApp: App {
   }
 }
 
+// Drives the genuine auto-update: a background check shortly after login and
+// every 6 hours while the menu-bar helper is resident. When a newer published
+// version exists (and the user hasn't skipped it), it prompts Update / Skip.
+final class AppDelegate: NSObject, NSApplicationDelegate {
+  private var timer: Timer?
+
+  func applicationDidFinishLaunching(_ notification: Notification) {
+    DispatchQueue.main.asyncAfter(deadline: .now() + 25) {
+      Actions.checkForUpdate(userInitiated: false)
+    }
+    let t = Timer(timeInterval: 6 * 3600, repeats: true) { _ in
+      Actions.checkForUpdate(userInitiated: false)
+    }
+    RunLoop.main.add(t, forMode: .common)
+    timer = t
+  }
+}
+
 
 final class UpdateStatusWindow: NSWindowController {
   private let stack = NSStackView()
@@ -734,6 +755,8 @@ final class UpdateStatusWindow: NSWindowController {
 }
 
 struct Actions {
+  static let home = FileManager.default.homeDirectoryForCurrentUser
+
   static func logoImage() -> NSImage? {
     guard
       let url = Bundle.main.url(forResource: "logo", withExtension: "svg"),
@@ -747,6 +770,141 @@ struct Actions {
   private static var isUpdating = false
   private static var updateWindow: UpdateStatusWindow?
 
+  // MARK: - Auto-update check
+
+  // Compare the installed CLI version to npm's published `latest`. Prompt only
+  // when newer and not skipped (background), or always report (user-initiated).
+  static func checkForUpdate(userInitiated: Bool) {
+    let installed = installedVersion()
+    latestVersion { latest in
+      DispatchQueue.main.async {
+        guard let latest = latest else {
+          if userInitiated {
+            showInfo(title: "Couldn’t check for updates", body: "Please check your connection and try again.")
+          }
+          return
+        }
+        guard let installed = installed, isNewer(latest, than: installed) else {
+          if userInitiated {
+            showInfo(title: "Drafted is up to date", body: "You’re on \(installed ?? "the latest") version.")
+          }
+          return
+        }
+        if !userInitiated && skippedVersion() == latest { return }
+        presentUpdateAlert(latest: latest, installed: installed)
+      }
+    }
+  }
+
+  static func presentUpdateAlert(latest: String, installed: String) {
+    Telemetry.report(event: "drafted_update_available", updateHelperStatus: "running")
+    let alert = NSAlert()
+    alert.messageText = "Drafted \(latest) is available"
+    alert.informativeText = "You have \(installed). Update now? Your editor needs to be restarted afterward to load the new MCP tools."
+    alert.addButton(withTitle: "Update")
+    alert.addButton(withTitle: "Skip This Version")
+    alert.addButton(withTitle: "Later")
+    if let logo = logoImage() { alert.icon = logo }
+    NSApp.activate(ignoringOtherApps: true)
+    switch alert.runModal() {
+    case .alertFirstButtonReturn:
+      updateDrafted()
+    case .alertSecondButtonReturn:
+      setSkippedVersion(latest)
+      Telemetry.report(event: "drafted_update_skipped", updateHelperStatus: "running")
+    default:
+      break
+    }
+  }
+
+  static func showInfo(title: String, body: String) {
+    let alert = NSAlert()
+    alert.messageText = title
+    alert.informativeText = body
+    alert.addButton(withTitle: "OK")
+    if let logo = logoImage() { alert.icon = logo }
+    NSApp.activate(ignoringOtherApps: true)
+    alert.runModal()
+  }
+
+  // Installed version via the CLI, run through a login shell so the npm-global
+  // bin is on PATH (the same shell the manual update uses).
+  static func installedVersion() -> String? {
+    let process = Process()
+    process.executableURL = URL(fileURLWithPath: "/bin/bash")
+    process.arguments = ["-lc", "drafted --version 2>/dev/null"]
+    let pipe = Pipe()
+    process.standardOutput = pipe
+    process.standardError = FileHandle.nullDevice
+    do { try process.run(); process.waitUntilExit() } catch { return nil }
+    let data = pipe.fileHandleForReading.readDataToEndOfFile()
+    guard let out = String(data: data, encoding: .utf8) else { return nil }
+    return firstSemver(in: out)
+  }
+
+  static func latestVersion(_ completion: @escaping (String?) -> Void) {
+    guard let url = URL(string: "https://registry.npmjs.org/drafted/latest") else { completion(nil); return }
+    var request = URLRequest(url: url)
+    request.timeoutInterval = 15
+    URLSession.shared.dataTask(with: request) { data, _, _ in
+      guard
+        let data = data,
+        let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+        let version = json["version"] as? String
+      else { completion(nil); return }
+      completion(version)
+    }.resume()
+  }
+
+  static func skippedVersion() -> String? {
+    let path = home.appendingPathComponent(".drafted/install.json")
+    guard
+      let data = try? Data(contentsOf: path),
+      let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any]
+    else { return nil }
+    return json["skippedVersion"] as? String
+  }
+
+  static func setSkippedVersion(_ version: String) {
+    let path = home.appendingPathComponent(".drafted/install.json")
+    var json = ((try? Data(contentsOf: path)).flatMap { try? JSONSerialization.jsonObject(with: $0) } as? [String: Any]) ?? [:]
+    json["skippedVersion"] = version
+    if let out = try? JSONSerialization.data(withJSONObject: json, options: [.prettyPrinted, .sortedKeys]) {
+      try? out.write(to: path)
+    }
+  }
+
+  // First dotted-numeric token in the text, e.g. "1.11.7" from "drafted 1.11.7".
+  static func firstSemver(in text: String) -> String? {
+    var current = ""
+    for ch in text {
+      if ch.isNumber || ch == "." {
+        current.append(ch)
+      } else {
+        if isSemver(current) { return current }
+        current = ""
+      }
+    }
+    return isSemver(current) ? current : nil
+  }
+
+  static func isSemver(_ s: String) -> Bool {
+    let parts = s.split(separator: ".")
+    return parts.count >= 2 && parts.allSatisfy { !$0.isEmpty && $0.allSatisfy { $0.isNumber } }
+  }
+
+  // Numeric, dot-separated comparison (our versions have no prerelease tags).
+  static func isNewer(_ a: String, than b: String) -> Bool {
+    let pa = a.split(separator: ".").map { Int($0) ?? 0 }
+    let pb = b.split(separator: ".").map { Int($0) ?? 0 }
+    for i in 0..<max(pa.count, pb.count) {
+      let x = i < pa.count ? pa[i] : 0
+      let y = i < pb.count ? pb[i] : 0
+      if x != y { return x > y }
+    }
+    return false
+  }
+
   static func updateDrafted() {
     if isUpdating {
       updateWindow?.showUpdating()

package/mcp/server.mjs

@@ -85,6 +85,7 @@ function getOrCreateSessionState(sid) {
     s = {
       activeProjectId: null,
       activeProjectMeta: null,
+      boundOrgId: null,
       loadedSkillIds: new Set(),
       gates: createGateState(),
       cachedOrgId: null,
@@ -699,6 +700,7 @@ async function cloneSession() {
       const data = await res.json();
       if (data.sessionId) {
         getState().sessionId = data.sessionId;
+        await restoreBoundOrg(data.orgId);
         return true;
       }
     }
@@ -706,6 +708,33 @@ async function cloneSession() {
   return false;
 }
 
+// A fresh clone inherits the ROOT login's current org. If this MCP session was
+// already working in a different org (bound via project open or get_org switch),
+// re-assert it on the new session so a WS-drop / 401 / server-bounce recovery is
+// transparent. Otherwise the recovered session silently lands on the root's org,
+// the next request appends the active project's id while scoped to the wrong org,
+// the API returns "project not found", and the api() error handler clears the
+// active project — the churn that shows up as active-project "flapping" after a
+// server restart. Best-effort: a raw fetch (not api()) avoids recursing back
+// through cloneSession on 401; if it fails, that stale-project clear is the
+// backstop, same as before this fix.
+async function restoreBoundOrg(clonedOrgId) {
+  const sess = getSessionState();
+  const want = sess.boundOrgId;
+  if (!want || want === clonedOrgId) return;
+  try {
+    const res = await fetch(`${getServerUrl()}/auth/switch-org`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...getAuthHeaders() },
+      body: JSON.stringify({ orgId: want }),
+    });
+    if (res.ok) {
+      sess.cachedOrgId = null;
+      sess.cachedOrgIdTime = 0;
+    }
+  } catch { /* best-effort; the api() stale-project clear is the backstop */ }
+}
+
 async function ensureSession() {
   if (getState().sessionId) return;
   // A pending device-code login (from `auth get_link`) takes priority; consuming
@@ -922,6 +951,11 @@ function setMcpActiveProject(projectId, meta = null) {
   const sess = getSessionState();
   sess.activeProjectId = projectId;
   sess.activeProjectMeta = meta;
+  // Remember the org this session is working in so session recovery (a re-clone
+  // after a WS drop / 401 / server bounce) can restore it instead of passively
+  // inheriting the root login's current org. Only set when known — a (null,null)
+  // clear must NOT wipe the bound org (the switch handler sets it explicitly).
+  if (meta?.orgId) sess.boundOrgId = meta.orgId;
 }
 
 // Clear the active project if its orgId no longer matches the current org.
@@ -1840,6 +1874,9 @@ tool('get_org', {
       // Clear active project too — projects are scoped to orgs, so the
       // previous one isn't valid in the new org.
       setMcpActiveProject(null, null);
+      // Bind this session to the chosen org so session recovery re-asserts it
+      // (set AFTER the clear above, which would otherwise leave it unchanged).
+      sess.boundOrgId = args.orgId;
       const me = await api('GET', '/auth/me');
       const orgs = (await api('GET', '/api/orgs')).orgs || [];
       const activeOrg = (orgs || []).map(o => ({ id: o.orgId || o.id, name: o.orgName || o.name })).find(o => o.id === me?.orgId) || null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.6",
+  "version": "1.11.8",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [