drafted 1.12.7 → 1.12.8

package/mcp/server.mjs

@@ -806,7 +806,7 @@ async function cloneSession() {
     // instead of churning a fresh session every process. (Org is per-request, so a
     // shared child session does NOT cause cross-agent org clobbering.)
     const agentKey = (process.env.DRAFTED_AGENT_NAME || '').trim() || bootstrapId;
-    const res = await fetch(`${getServerUrl()}/auth/session/clone`, {
+    const res = await serverFetch(`${getServerUrl()}/auth/session/clone`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Cookie: `gc_session=${bootstrapId}` },
       body: JSON.stringify({ agentKey }),
@@ -838,7 +838,7 @@ async function restoreBoundOrg(clonedOrgId) {
   const want = sess.boundOrgId;
   if (!want || want === clonedOrgId) return;
   try {
-    const res = await fetch(`${getServerUrl()}/auth/switch-org`, {
+    const res = await serverFetch(`${getServerUrl()}/auth/switch-org`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', ...getAuthHeaders() },
       body: JSON.stringify({ orgId: want }),
@@ -868,6 +868,37 @@ const MIME_MAP = {
 };
 function mimeFromExt(ext) { return MIME_MAP[ext?.toLowerCase()] || 'application/octet-stream'; }
 
+// TLS-trust failures from antivirus/corporate HTTPS interception (Norton,
+// Zscaler, ...) surface from undici as a bare "fetch failed" — agents then tell
+// users "network error / you're offline" for a day (real incident, 2026-07-02).
+// Node does not use the OS certificate store, so the interceptor's re-signed
+// chain is untrusted. Translate the code into the actual fix.
+const TLS_TRUST_CODES = new Set([
+  'UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'SELF_SIGNED_CERT_IN_CHAIN',
+  'DEPTH_ZERO_SELF_SIGNED_CERT', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+  'UNABLE_TO_GET_ISSUER_CERT', 'CERT_UNTRUSTED',
+]);
+function enrichFetchError(error, url) {
+  const code = String(error?.cause?.code || error?.code || '').toUpperCase();
+  if (!TLS_TRUST_CODES.has(code)) return error;
+  const e = new Error(
+    `TLS interception detected reaching ${url} (${code}): antivirus or a corporate proxy ` +
+    `(Norton, Zscaler, Netskope, ...) is re-signing HTTPS, and Node does not use the OS ` +
+    `certificate store, so it rejects the interceptor's certificate. This is NOT a Drafted ` +
+    `outage and NOT a sign-out. Fixes, best first: (1) exclude drafted.live and *.drafted.live ` +
+    `from the interceptor's HTTPS/SSL scanning; (2) export the interceptor's root certificate ` +
+    `to a PEM file and set NODE_EXTRA_CA_CERTS=<path> in this MCP server's env; (3) on Node ` +
+    `>= 22.15, set NODE_OPTIONS=--use-system-ca so Node trusts the OS store. NEVER set ` +
+    `NODE_TLS_REJECT_UNAUTHORIZED=0 (disables all TLS verification).`
+  );
+  e.cause = error;
+  return e;
+}
+async function serverFetch(url, opts) {
+  try { return await fetch(url, opts); }
+  catch (e) { throw enrichFetchError(e, url); }
+}
+
 async function api(method, path, body, extraHeaders = {}, _retried = false) {
   await ensureSession();
   const pid = getState().projectId;
@@ -899,7 +930,7 @@ async function api(method, path, body, extraHeaders = {}, _retried = false) {
     opts.body = JSON.stringify(body);
   }
 
-  const res = await fetch(url, opts);
+  const res = await serverFetch(url, opts);
   const text = await res.text();
 
   // Session expired after server restart, or a browser approval just completed
@@ -1399,7 +1430,7 @@ async function consumePendingDeviceCode() {
   if (!pending?.deviceCode) return false;
 
   try {
-    const res = await fetch(`${getServerUrl()}/auth/device/token`, {
+    const res = await serverFetch(`${getServerUrl()}/auth/device/token`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ deviceCode: pending.deviceCode }),
@@ -1435,7 +1466,7 @@ if (!isRemote) tool('auth', 'Sign in to Drafted. `action=get_link` returns a ver
 }, async ({ action }) => {
   try {
     if (action === 'get_link') {
-      const codeRes = await fetch(`${getServerUrl()}/auth/device/code`, { method: 'POST' });
+      const codeRes = await serverFetch(`${getServerUrl()}/auth/device/code`, { method: 'POST' });
       if (!codeRes.ok) throw new Error(`Failed to start device authorization (HTTP ${codeRes.status})`);
       const data = await codeRes.json();
       persistPendingDeviceCode(data);
@@ -1449,7 +1480,7 @@ if (!isRemote) tool('auth', 'Sign in to Drafted. `action=get_link` returns a ver
       const existing = getState().sessionId || getBootstrapSessionId();
       if (existing) {
         try {
-          const res = await fetch(`${getServerUrl()}/auth/me`, {
+          const res = await serverFetch(`${getServerUrl()}/auth/me`, {
             headers: { Cookie: `gc_session=${existing}` },
           });
           if (res.ok) {
@@ -1467,7 +1498,7 @@ if (!isRemote) tool('auth', 'Sign in to Drafted. `action=get_link` returns a ver
         ({ deviceCode, verificationUrl, expiresIn } = pending);
         reusingPending = true;
       } else {
-        const codeRes = await fetch(`${getServerUrl()}/auth/device/code`, { method: 'POST' });
+        const codeRes = await serverFetch(`${getServerUrl()}/auth/device/code`, { method: 'POST' });
         if (!codeRes.ok) throw new Error(`Failed to start device authorization (HTTP ${codeRes.status})`);
         ({ deviceCode, verificationUrl, expiresIn } = await codeRes.json());
       }
@@ -1491,7 +1522,7 @@ if (!isRemote) tool('auth', 'Sign in to Drafted. `action=get_link` returns a ver
       const deadline = Date.now() + (expiresIn * 1000);
       while (Date.now() < deadline) {
         await new Promise(r => setTimeout(r, 4000));
-        const res = await fetch(`${getServerUrl()}/auth/device/token`, {
+        const res = await serverFetch(`${getServerUrl()}/auth/device/token`, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ deviceCode }),
@@ -1543,15 +1574,18 @@ async function sessionSurfaceBlock() {
   const cookieSid = sessionId || getBootstrapSessionId();
   let me = null;
   let unreachable = false;
+  let unreachableWhy = null;
   if (cookieSid) {
     try {
-      const res = await fetch(`${getServerUrl()}/auth/me`, { headers: { Cookie: `gc_session=${cookieSid}` } });
+      const res = await serverFetch(`${getServerUrl()}/auth/me`, { headers: { Cookie: `gc_session=${cookieSid}` } });
       if (res.ok) me = await res.json();
-    } catch {
+    } catch (e) {
       // Transport failure, NOT a sign-out. Conflating the two made agents tell
       // users "you're signed out" during a network blip and start needless
-      // re-logins — surface the distinction instead.
+      // re-logins — surface the distinction instead. serverFetch already
+      // translates TLS-interception codes into the actual fix.
       unreachable = true;
+      if (String(e?.message || '').startsWith('TLS interception')) unreachableWhy = e.message;
     }
   }
   return {
@@ -1566,7 +1600,7 @@ async function sessionSurfaceBlock() {
     alive: false,
     ...(unreachable ? {
       serverUnreachable: true,
-      note: `Could not reach ${getServerUrl()} — identity UNKNOWN, not signed out. This is a network/transport failure: do not tell the user they are logged out and do not start a new login; retry when connectivity is back.`,
+      note: unreachableWhy || `Could not reach ${getServerUrl()} — identity UNKNOWN, not signed out. This is a network/transport failure: do not tell the user they are logged out and do not start a new login; retry when connectivity is back.`,
     } : {}),
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.12.7",
+  "version": "1.12.8",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [