drafted 1.11.8 → 1.11.10

package/cli/drafted.mjs

@@ -221,6 +221,89 @@ async function authFetch(url, options = {}) {
   return fetch(url, { ...options, headers });
 }
 
+// --- Read helpers (remote, read-only) ---
+
+// Append non-empty query params to a path/URL.
+function withQuery(base, params) {
+  const usp = new URLSearchParams();
+  for (const [k, v] of Object.entries(params)) {
+    if (v !== undefined && v !== null && v !== '') usp.set(k, String(v));
+  }
+  const qs = usp.toString();
+  return qs ? `${base}?${qs}` : base;
+}
+
+// GET a Drafted API path with the stored session and return parsed JSON.
+// Strictly read-only: callers only ever issue GETs through this seam. On any
+// failure it emits a structured error (for --json) and exits non-zero.
+async function readApiGet(command, apiPath) {
+  requireLogin();
+  const serverUrl = getServerUrl();
+  let res;
+  try {
+    res = await authFetch(`${serverUrl}${apiPath}`);
+  } catch (err) {
+    jsonOut(false, command, `Could not reach server at ${serverUrl}: ${err.message}`);
+    console.error(`❌ Could not reach server at ${serverUrl}: ${err.message}`);
+    process.exit(1);
+  }
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const msg = data.error || `HTTP ${res.status}`;
+    jsonOut(false, command, msg);
+    console.error(`❌ ${msg}`);
+    process.exit(1);
+  }
+  return data;
+}
+
+// Resolve a frame path / frame URL (/f/<uuid>) / bare UUID to its /api/fs read
+// endpoint. Mirrors the MCP `frame(action="read")` resolution so the CLI and MCP
+// accept the same identifiers.
+function frameReadPath(pathOrId, projectId, lines) {
+  const frameUrlMatch = pathOrId.match(/\/f\/([a-f0-9-]{36})/);
+  const uuidMatch = /^[a-f0-9-]{36}$/.test(pathOrId);
+  const frameId = frameUrlMatch?.[1] || (uuidMatch ? pathOrId : null);
+  if (frameId) return withQuery(`/api/fs/by-id/${frameId}`, { projectId, lines });
+  const parts = pathOrId.replace(/^\/+/, '').split('/');
+  if (parts.length !== 3) {
+    throw new Error('Path must be /{layer}/{lane}/{filename}, a frame URL, or a frame ID');
+  }
+  return withQuery(`/api/fs/${parts[0]}/${parts[1]}/${parts[2]}`, { projectId, lines });
+}
+
+// Human-readable printer for `ls` output. Handles both the rich root listing
+// ({ layers, connectors }) and a path listing ({ path, entries }).
+function printLs(data) {
+  const proj = data.project;
+  if (proj) {
+    const name = typeof proj === 'string' ? proj : (proj.name || proj.slug || proj.id);
+    console.log(`Project: ${name}${proj.workflow ? `  (${proj.workflow})` : ''}`);
+    console.log('');
+  }
+  if (Array.isArray(data.layers)) {
+    for (const l of data.layers) {
+      console.log(`  ${l.path}  —  ${l.label || ''}`);
+      for (const lane of l.lanes || []) console.log(`    ${lane}`);
+      for (const a of l.anchored || []) console.log(`    * ${a.path} (anchored)`);
+    }
+    if (Array.isArray(data.connectors) && data.connectors.length) {
+      console.log('');
+      console.log(`  Connectors (${data.connectors.length}):`);
+      for (const c of data.connectors) console.log(`    ${c.source} → ${c.target}${c.label ? `  "${c.label}"` : ''}`);
+    }
+    return;
+  }
+  const entries = data.entries || [];
+  console.log(`${data.path || '/'} (${entries.length}):`);
+  for (const e of entries) {
+    const meta = e.type === 'frame'
+      ? `  [${e.contentType || e.title || 'frame'}${e.size != null ? `, ${e.size}b` : ''}]`
+      : '';
+    console.log(`  ${e.path}${e.type && e.type !== 'frame' ? '/' : ''}${meta}`);
+  }
+}
+
 // Global options
 program
   .option('--json', 'Output as JSON');
@@ -1054,18 +1137,106 @@ program
     }
   });
 
-// Commands removed: list, remove, clear
-// These now live in the MCP server as fs tools (ls, rm, batch)
-// Use the Drafted MCP tools or the /api/fs/* REST API instead.
+// ── Read commands (read-only) ─────────────────────────────────────
+// Scriptable, non-interactive reads for external automation / CI. These mirror
+// the rich read ops the MCP exposes but over the same authenticated /api/fs/
+// surface the `add` command already uses — strictly GET, scoped to the logged-in
+// user's own orgs/projects. No new data exposure beyond what the MCP grants.
+//
+// Project scoping: --project <id> selects the project (passed through as a query
+// param). When omitted, the server resolves the caller's active project. Org is
+// the logged-in session's active org — identical to `add`. (Cross-org reads
+// require switching org first; a per-request --org override is a deliberate
+// follow-up, not added here to avoid implying access the /api/fs/ routes don't
+// yet scope.)
+
+// Command: ls (alias: list) — list layers / lanes / frames
+program
+  .command('ls [path]')
+  .alias('list')
+  .description('List layers, lanes, or frames in a project (read-only)')
+  .option('--project <id>', 'Target project ID (defaults to your active project)')
+  .option('--recursive', 'Recurse into subdirectories (forces summary mode)')
+  .option('--summary', 'Include size, updatedAt, and title for frames')
+  .option('--pattern <glob>', 'Filter frame filenames (e.g. "*.html")')
+  .action(async (path, options) => {
+    const params = { path: path || '/', projectId: options.project, pattern: options.pattern };
+    if (options.recursive) { params.recursive = 'true'; params.summary = 'true'; }
+    else if (options.summary) params.summary = 'true';
+    const data = await readApiGet('ls', withQuery('/api/fs/', params));
+    jsonOut(true, 'ls', data);
+    printLs(data);
+  });
 
-// Legacy stubs for backward compat (inform users)
+// Command: read (aliases: get, cat) — read a frame's content
 program
+  .command('read <pathOrId>')
+  .aliases(['get', 'cat'])
+  .description("Read a frame's content (HTML/text/markdown), or binary metadata, by path / frame URL / ID (read-only)")
+  .option('--project <id>', 'Target project ID (defaults to your active project)')
+  .option('--lines <range>', 'Line range to read, e.g. "1-40" or "20"')
+  .action(async (pathOrId, options) => {
+    let apiPath;
+    try {
+      apiPath = frameReadPath(pathOrId, options.project, options.lines);
+    } catch (err) {
+      jsonOut(false, 'read', err.message);
+      console.error(`❌ ${err.message}`);
+      process.exit(1);
+    }
+    const data = await readApiGet('read', apiPath);
+    jsonOut(true, 'read', data);
+    if (data.type === 'binary') {
+      console.log(`# ${data.path} (binary)`);
+      if (data.contentType) console.log(`Type: ${data.contentType}`);
+      if (data.sourceUrl) console.log(`Storage key: ${data.sourceUrl}`);
+    } else {
+      // Emit raw content to stdout so callers can pipe it into extractors
+      // (e.g. pull <script type="application/json" id="..."> token blocks).
+      const content = data.content || '';
+      process.stdout.write(content);
+      if (content && !content.endsWith('\n')) process.stdout.write('\n');
+    }
+  });
+
+// Command: asset — read-only project asset operations
+const assetCmd = program.command('asset').description('Project asset operations (read-only)');
+
+assetCmd
   .command('list')
-  .description('(deprecated) Use MCP tools: ls')
-  .action(() => {
-    console.log('The `list` command has been removed.');
-    console.log('Use the Drafted MCP tools (ls) or the /api/fs/ REST API instead.');
-    process.exit(0);
+  .description('List supporting assets (CSS/JS/images/fonts) in a project')
+  .requiredOption('--project <id>', 'Target project ID')
+  .option('--frame <id>', 'Only assets associated with this frame ID')
+  .action(async (options) => {
+    const apiPath = withQuery(`/api/projects/${encodeURIComponent(options.project)}/assets`, { frameId: options.frame });
+    const data = await readApiGet('asset-list', apiPath);
+    jsonOut(true, 'asset-list', data);
+    const assets = data.assets || [];
+    if (assets.length === 0) { console.log('No assets'); return; }
+    console.log(`Assets (${assets.length}):\n`);
+    for (const a of assets) {
+      console.log(`  ${a.path}\t${a.contentType || ''}${a.size != null ? `\t${a.size} bytes` : ''}`);
+    }
+  });
+
+assetCmd
+  .command('get <asset_path>')
+  .description("Show a single asset's metadata (path, type, size, frame). Metadata only — asset bytes are not served over the API.")
+  .requiredOption('--project <id>', 'Target project ID')
+  .action(async (assetPath, options) => {
+    const data = await readApiGet('asset-get', `/api/projects/${encodeURIComponent(options.project)}/assets`);
+    const wanted = assetPath.replace(/^\/+/, '');
+    const asset = (data.assets || []).find(a => a.path === assetPath || a.path === wanted);
+    if (!asset) {
+      jsonOut(false, 'asset-get', `Asset not found: ${assetPath}`);
+      console.error(`❌ Asset not found: ${assetPath}`);
+      process.exit(1);
+    }
+    jsonOut(true, 'asset-get', { asset });
+    console.log(asset.path);
+    console.log(`  Type: ${asset.contentType || 'unknown'}`);
+    console.log(`  Size: ${asset.size != null ? `${asset.size} bytes` : 'unknown'}`);
+    if (asset.frameId) console.log(`  Frame: ${asset.frameId}`);
   });
 
 program

package/install-mcp.sh

@@ -827,19 +827,35 @@ struct Actions {
     alert.runModal()
   }
 
-  // Installed version via the CLI, run through a login shell so the npm-global
-  // bin is on PATH (the same shell the manual update uses).
+  // Installed version, resolved WITHOUT depending on the login-shell PATH —
+  // the installer's npm prefix (~/.drafted/npm-global) is never written to any
+  // login profile, so `bash -lc "drafted"` finds nothing. Read the installed
+  // package.json at the fixed prefix first (the source npm itself writes), then
+  // fall back to the absolute binary, then a login shell (custom prefixes on PATH).
   static func installedVersion() -> String? {
-    let process = Process()
-    process.executableURL = URL(fileURLWithPath: "/bin/bash")
-    process.arguments = ["-lc", "drafted --version 2>/dev/null"]
-    let pipe = Pipe()
-    process.standardOutput = pipe
-    process.standardError = FileHandle.nullDevice
-    do { try process.run(); process.waitUntilExit() } catch { return nil }
-    let data = pipe.fileHandleForReading.readDataToEndOfFile()
-    guard let out = String(data: data, encoding: .utf8) else { return nil }
-    return firstSemver(in: out)
+    let pkg = home.appendingPathComponent(".drafted/npm-global/lib/node_modules/drafted/package.json")
+    if
+      let data = try? Data(contentsOf: pkg),
+      let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+      let version = json["version"] as? String,
+      isSemver(version)
+    { return version }
+
+    let bin = home.appendingPathComponent(".drafted/npm-global/bin/drafted").path
+    for command in ["\"\(bin)\" --version 2>/dev/null", "drafted --version 2>/dev/null"] {
+      let process = Process()
+      process.executableURL = URL(fileURLWithPath: "/bin/bash")
+      process.arguments = ["-lc", command]
+      let pipe = Pipe()
+      process.standardOutput = pipe
+      process.standardError = FileHandle.nullDevice
+      do { try process.run(); process.waitUntilExit() } catch { continue }
+      let data = pipe.fileHandleForReading.readDataToEndOfFile()
+      if let out = String(data: data, encoding: .utf8), let version = firstSemver(in: out) {
+        return version
+      }
+    }
+    return nil
   }
 
   static func latestVersion(_ completion: @escaping (String?) -> Void) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.11.8",
+  "version": "1.11.10",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [