drafted 1.19.18 → 1.19.19

package/cli/drafted.mjs

@@ -300,11 +300,20 @@ async function readApiGet(command, apiPath, org) {
     // A valid session now targets the server it was minted for (see getServerUrl),
     // so a 401/403 here means the credential is genuinely missing/expired — surface
     // an actionable next step instead of the bare server "Unauthenticated" string.
-    if (res.status === 401 || res.status === 403) {
-      // Name BOTH paths. `drafted login` is interactive, so an agent that reads
-      // only this line hands its user a shell command instead of a link — which
-      // is what happened. An agent should call the MCP auth tool and surface the
-      // URL it returns; approval writes the shared auth file, fixing the CLI too.
+    // THE SERVER'S MESSAGE WINS. This used to replace every 401/403 with "your
+    // session is missing or expired — run `drafted login`", which is a guess. A
+    // valid, signed-in session that simply had not been NAMED yet returns 403
+    // {code:'session_unnamed'} with the exact remedy in the body — and that got
+    // discarded and reported as an auth failure, sending readers off to re-run a
+    // device-code login that could never fix it. Only invent a message when the
+    // server sent none.
+    // A bare `{"error":"Unauthenticated"}` explains nothing, so the actionable
+    // auth message is genuinely better. A body with a `code` is the server
+    // naming a SPECIFIC condition (session_unnamed, and anything added later)
+    // and usually carrying its own remedy — replacing that is what sent the last
+    // reader off to re-run a login that could not have helped.
+    const serverNamedTheReason = typeof data?.code === 'string' && data.code && data.code !== 'unauthenticated';
+    if ((res.status === 401 || res.status === 403) && !serverNamedTheReason) {
       msg = `Not authenticated for ${serverUrl} — your Drafted session is missing or expired. `
         + `If you are a person at a terminal: run \`drafted login\`. `
         + `If you are an agent: call the Drafted MCP auth tool with action="get_link" and give the URL to your user — you cannot complete a sign-in yourself. `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.18",
+  "version": "1.19.19",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [