drafted 1.12.3 → 1.12.5

package/install-mcp.sh

@@ -692,6 +692,13 @@ install_desktop_app() {
   # Clear quarantine so Gatekeeper doesn't block a freshly downloaded bundle.
   xattr -dr com.apple.quarantine "$app_bundle" >/dev/null 2>&1 || true
 
+  # Kill any already-running instance first — including a stray one that isn't
+  # launchd-managed (e.g. left over from a prior run of this same installer,
+  # before this pkill existed: `open` below used to spawn a second, untracked
+  # process alongside the launchd-supervised one, and `launchctl bootout` only
+  # ever stops the launchd-managed process, not that rogue one).
+  pkill -x "$exe_name" >/dev/null 2>&1 || true
+
   # Register run-at-login for the new app (mirrors the legacy launch agent).
   uid="$(id -u)"
   plist="$HOME/Library/LaunchAgents/live.drafted.desktop.plist"
@@ -714,9 +721,11 @@ install_desktop_app() {
 </dict>
 </plist>
 PLIST
+  # launchctl bootstrap + RunAtLoad is the sole launch path — it already starts
+  # the app, so a trailing `open "$app_bundle"` here would start a second,
+  # launchd-unaware process every time this function runs (that was the bug).
   launchctl bootout "gui/$uid" "$plist" >/dev/null 2>&1 || true
   launchctl bootstrap "gui/$uid" "$plist" >/dev/null 2>&1 || true
-  open "$app_bundle" >/dev/null 2>&1 || true
   return 0
 }
 

package/mcp/server.mjs

@@ -3113,7 +3113,7 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
   path: z.string().optional().describe('[read_file|update_file] relative path inside skill directory (e.g. "examples/react.md")'),
   offset: z.number().optional().describe('[search|list] skip N results for pagination; [read_file] start reading at this byte offset (default 0) — for large files (e.g. a >90KB app-frame bundle) read in chunks using the returned nextOffset until truncated=false'),
   maxBytes: z.number().optional().describe('[read_file] return at most this many bytes from offset (default: whole remaining file). Response reports totalSize/offset/truncated/nextOffset.'),
-  org: z.string().optional().describe('[fork|push|update] resolve/fork into this Drafted org (id or name); scopes the request without switching the active org'),
+  org: z.string().optional().describe('[add] org (id or name) to create the skill in — defaults to the bound/active org; [fork|push|update] resolve/fork into this Drafted org (id or name); scopes the request without switching the active org'),
   setup: z.array(z.string()).optional().describe('[add|update] setup command(s) (in order) run on materialize to build a source-only skill, e.g. ["npm ci","npm run build"]'),
   files: z.array(z.object({ path: z.string(), content: z.string() })).optional().describe('[push] source files to push (path + UTF-8 content); server strips artifacts + enforces caps'),
   dir: z.string().optional().describe('[push] local directory to push instead of files[]; walked locally (heavy dirs, .skillinstall/, and .skillignore pre-filtered), server re-enforces. On push the dir\'s .gitignore is auto-updated to exclude .skillinstall/ (the rebuildable bundle).'),
@@ -3194,13 +3194,16 @@ tool('skill', 'Manage the Drafted skill library. Skills are reusable prompts/gui
       case 'add': {
         const g2 = g2Block(getSessionState().gates);
         if (g2) return err(new Error(g2));
-        const { name, description, content, tags, triggerPatterns, setup } = args;
+        const { name, description, content, tags, triggerPatterns, setup, org } = args;
         if (!name || !description || !content) throw new Error('name, description, content required for action=add');
         const body = { name, description, content };
         if (tags) body.tags = tags;
         if (triggerPatterns) body.triggerPatterns = triggerPatterns;
         if (setup !== undefined) body.setup = setup;
-        return ok(await api('POST', '/api/skills', body));
+        // org names where the skill is born (UUID-first model: org is explicit at
+        // create) — without this the bound-org guard accepts org= but the write
+        // would land in the session org anyway.
+        return ok(await api('POST', '/api/skills', body, org ? { 'X-Drafted-Org': org } : {}));
       }
       case 'update': {
         // Auto-fork-on-update (tool behavior): if the target is read-only (global/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.12.3",
+  "version": "1.12.5",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [