drafted 1.19.24 → 1.19.25

package/mcp/server.mjs

@@ -2218,7 +2218,32 @@ if (!isRemote) tool('auth', 'Sign in to Drafted.\n\n`action=get_link` ALWAYS ret
           });
           if (res.ok) {
             const me = await res.json();
-            return ok({ status: 'already_authenticated', userId: me.userId, email: me.userEmail, org: me.currentOrg?.name });
+            // "Signed in" has to mean THIS MACHINE is signed in, not "this process
+            // happens to hold a session". The two came apart the first time anything
+            // deleted ~/.drafted/auth.json underneath a running MCP (the desktop's
+            // credential burn does exactly that, by design): the in-process session
+            // stayed valid, so login answered already_authenticated — truthfully, and
+            // uselessly — while every OTHER reader on the machine stayed signed out.
+            // The desktop's focus listener is one of those readers, so an agent asking
+            // for a human reached nobody and the tool that exists to fix it reported
+            // success.
+            let restoredAuthFile = false;
+            if (!getBootstrapSessionId()) {
+              try {
+                persistAuthSession({ sessionId: existing, userId: me.userId, orgId: me.currentOrg?.id });
+                restoredAuthFile = true;
+              } catch { /* read-only home: report the truth below rather than throwing */ }
+            }
+            return ok({
+              status: 'already_authenticated',
+              userId: me.userId,
+              email: me.userEmail,
+              org: me.currentOrg?.name,
+              ...(restoredAuthFile ? {
+                restoredAuthFile: true,
+                note: 'This session was signed in but ~/.drafted/auth.json was missing, so other readers on this machine (the desktop app, the CLI) were not. Rewrote it from the live session.',
+              } : {}),
+            });
           }
         } catch { /* session invalid, proceed with login */ }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.24",
+  "version": "1.19.25",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [

package/src/shared/root-route.mjs

@@ -0,0 +1,45 @@
+/**
+ * ONE definition of the root-URL grammar, shared by the server, the client
+ * router and the tests:
+ *
+ *   /o/<org>[/<folder chain>]/wiki|skills|tasks|projects[/<path>]
+ *
+ * The regex is a literal copy of the four root routes in server/server.mjs. It
+ * must stay that way: the client router uses it to decide what it may handle
+ * without a round trip, so any divergence renders a different page than the URL
+ * names.
+ *
+ * The source form carries ZERO BACKSLASHES on purpose. This function is
+ * embedded into client JS via `String(parseRootPath)` inside a template literal
+ * (see AGENTS.md's escape trap: a `\/` written inside a template literal
+ * collapses to `/`). Interpolating a runtime string is safe either way, but a
+ * body with no backslashes cannot be broken by a later copy-paste into a
+ * literal region.
+ */
+
+export const ROOTS = ['wiki', 'skills', 'tasks', 'projects'];
+
+/**
+ * @param {string} pathname
+ * @returns {{orgParam: string, chain: string, root: string, path: string}|null}
+ *   `null` means "not a root URL" — the caller must let the server decide.
+ *   `chain` is decoded ('' = the org itself); `path` is left RAW/encoded,
+ *   exactly as the server's `req.params[2]` is, so both halves agree.
+ */
+export function parseRootPath(pathname) {
+  var re = new RegExp('^/o/([^/]+)/(?:(.+?)/)?(wiki|skills|tasks|projects)(?:/(.*))?$');
+  var m = re.exec(String(pathname || ''));
+  if (!m) return null;
+  var path = m[4] || '';
+  while (path.length && path.charAt(path.length - 1) === '/') path = path.slice(0, -1);
+  // The projects root takes NO sub-path on the server, because
+  // /o/<org>/projects/<slug> is the PROJECT CANVAS. Claiming it here would make
+  // the client router swallow every project link and render the folder list.
+  if (m[3] === 'projects' && path) return null;
+  return {
+    orgParam: decodeURIComponent(m[1]),
+    chain: m[2] ? decodeURIComponent(m[2]) : '',
+    root: m[3],
+    path: path,
+  };
+}