drafted 1.19.48 → 1.19.51

package/install-mcp.sh

@@ -550,47 +550,93 @@ else
   PLUGIN_SRC=""
 fi
 
+# Skills and commands are LINKED, never copied: a copy is a point-in-time snapshot that only
+# refreshes when someone re-runs this installer, so `npm i -g drafted@latest` would leave the
+# installed skill silently behind the package it came from. A link tracks the upgrade.
+#
+# link_plugin_entry is idempotent and non-destructive: a correct link is left alone, a wrong or
+# dangling one is repointed, and a real file/directory (which the user may have written by hand)
+# is moved aside rather than deleted. Backups go OUTSIDE the skills/commands dirs — a
+# `drafted.backup/` sitting next to `drafted/` would register as a second, stale skill.
+DRAFTED_BACKUP_DIR="$HOME/.claude/.drafted-backups"
+link_plugin_entry() {
+  local source="$1" target="$2" source_real backup
+  source_real="$(cd "$(dirname "$source")" && pwd)/$(basename "$source")"
+  if [ -L "$target" ]; then
+    if [ "$(readlink "$target")" = "$source_real" ]; then return 0; fi
+    rm -f "$target"
+  elif [ -e "$target" ]; then
+    # Byte-identical to the source: this is a prior copy-install of ours, not user content, and
+    # the link reproduces it losslessly. Anything else is backed up.
+    if diff -rq "$source_real" "$target" >/dev/null 2>&1; then
+      rm -rf "$target"
+    else
+      mkdir -p "$DRAFTED_BACKUP_DIR"
+      backup="$DRAFTED_BACKUP_DIR/$(basename "$target").$(date +%Y%m%d%H%M%S)"
+      mv "$target" "$backup"
+      echo -e "    ${YELLOW}Existing $(basename "$target") moved aside → $backup${RESET}"
+    fi
+  fi
+  ln -s "$source_real" "$target"
+}
+
+# Remove links WE made whose source is gone — an entry dropped from the package, or the package
+# uninstalled entirely. A dangling skill dir is worse than a stale one: it looks installed and
+# loads nothing. Matched on the link's own target path so other installers' links are untouched.
+sweep_plugin_links() {
+  local dir="$1" marker="$2" link
+  [ -d "$dir" ] || return 0
+  while IFS= read -r link; do
+    case "$(readlink "$link")" in
+      *"$marker"*)
+        if [ ! -e "$link" ]; then
+          rm -f "$link"
+          echo -e "    ${YELLOW}Removed stale link: $(basename "$link")${RESET}"
+        fi
+        ;;
+    esac
+  done < <(find "$dir" -maxdepth 1 -type l 2>/dev/null)
+}
+
 # Skills — Claude Code auto-loads these from ~/.claude/skills/<name>/SKILL.md
+SKILLS_DIR="$HOME/.claude/skills"
+sweep_plugin_links "$SKILLS_DIR" "/plugin/skills/"
 if [ -n "$PLUGIN_SRC" ] && [ -d "$PLUGIN_SRC/skills" ]; then
-  SKILLS_DIR="$HOME/.claude/skills"
   mkdir -p "$SKILLS_DIR"
   SKILL_COUNT=0
   for d in "$PLUGIN_SRC/skills/"*/; do
     [ -d "$d" ] || continue
     DIRNAME="$(basename "$d")"
-    rm -rf "$SKILLS_DIR/$DIRNAME"
-    cp -r "$d" "$SKILLS_DIR/$DIRNAME"
+    link_plugin_entry "${d%/}" "$SKILLS_DIR/$DIRNAME"
     SKILL_COUNT=$((SKILL_COUNT + 1))
   done
-  ok "Installed $SKILL_COUNT skill(s) to $SKILLS_DIR"
+  ok "Linked $SKILL_COUNT skill(s) into $SKILLS_DIR (source: $PLUGIN_SRC/skills)"
 else
   echo -e "    ${YELLOW}Skill source not found in package — skipping skills.${RESET}"
 fi
 
 # Commands — namespaced under drafted/ so they register as /drafted:<name>,
-# matching the marketplace install and the commands' own cross-references.
+# matching the marketplace install and the commands' own cross-references. Linked per FILE into a
+# real directory (not a linked directory) so discovery is unchanged; the containing dir is no
+# longer rm -rf'd, so anything else a user put there survives.
+CLAUDE_CMD_DIR="$HOME/.claude/commands/drafted"
+CODEX_CMD_DIR="$HOME/.codex/prompts/drafted"
+sweep_plugin_links "$CLAUDE_CMD_DIR" "/plugin/commands/"
+sweep_plugin_links "$CODEX_CMD_DIR" "/plugin/commands/"
 if [ -n "$PLUGIN_SRC" ] && [ -d "$PLUGIN_SRC/commands" ]; then
-  CMD_COUNT=0
-  for f in "$PLUGIN_SRC/commands/"*.md; do
-    [ -f "$f" ] || continue
-    CMD_COUNT=$((CMD_COUNT + 1))
-  done
-
-  if [ "$CLIENT_CLAUDE_CODE" = true ]; then
-    CLAUDE_CMD_DIR="$HOME/.claude/commands/drafted"
-    rm -rf "$CLAUDE_CMD_DIR"
-    mkdir -p "$CLAUDE_CMD_DIR"
-    cp "$PLUGIN_SRC/commands/"*.md "$CLAUDE_CMD_DIR/" 2>/dev/null || true
-    ok "Installed $CMD_COUNT command(s) to $CLAUDE_CMD_DIR"
-  fi
+  link_commands_into() {
+    local dest="$1" count=0 f
+    mkdir -p "$dest"
+    for f in "$PLUGIN_SRC/commands/"*.md; do
+      [ -f "$f" ] || continue
+      link_plugin_entry "$f" "$dest/$(basename "$f")"
+      count=$((count + 1))
+    done
+    ok "Linked $count command(s) into $dest"
+  }
 
-  if [ "$CLIENT_CODEX" = true ]; then
-    CODEX_CMD_DIR="$HOME/.codex/prompts/drafted"
-    rm -rf "$CODEX_CMD_DIR"
-    mkdir -p "$CODEX_CMD_DIR"
-    cp "$PLUGIN_SRC/commands/"*.md "$CODEX_CMD_DIR/" 2>/dev/null || true
-    ok "Installed $CMD_COUNT command(s) to $CODEX_CMD_DIR"
-  fi
+  if [ "$CLIENT_CLAUDE_CODE" = true ]; then link_commands_into "$CLAUDE_CMD_DIR"; fi
+  if [ "$CLIENT_CODEX" = true ]; then link_commands_into "$CODEX_CMD_DIR"; fi
 else
   echo -e "    ${YELLOW}Command source not found in package — skipping commands.${RESET}"
 fi

package/mcp/server.mjs

@@ -3308,6 +3308,7 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
   recursive: z.boolean().optional().describe('[ls] recurse into subdirectories'),
   lines: z.string().optional().describe('[read] line range (e.g. "1-50") — partial read; content is hashline-annotated so a later edit stays surgical'),
   pattern: z.string().optional().describe('[ls] filter filenames (e.g. "*.html")'),
+  readonly: z.boolean().optional().describe('[link] read-only frame link (symlink): mirror the SOURCE frame named by `to` (a frame UUID or /projects/<other-project>/<layer>/<lane>/<file>) into the CURRENT project, displayed read-only. The source project stays the single writer.'),
   org: z.string().optional().describe('Org (id or name) for bare /wiki and /skills paths (org-scoped /o/<org>/... paths don\'t need it). Per-request only; project paths self-derive org from the project row.'),
   projectId: PROJECT_OVERRIDE_PARAM,
 }, async (args) => {
@@ -4215,6 +4216,34 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
           if (!filePath) return err(new Error(`${action} requires a source file path: /projects/<project>/<layer>/<lane>/<file>`));
           const from = lane ? `/${layer}/${lane}/${filename}` : `/${layer}/${filename}`;
           const body = { from };
+          if (action === 'link' && args.readonly) {
+            // Read-only frame link (symlink): mirror the frame INTO the current
+            // project read-only. `to` names the SOURCE frame — a frame UUID or an
+            // fs path in another project (/projects/<slug>/<layer>/<lane>/<file>).
+            if (!to) return err(new Error('readonly link requires to=<source frame path in another project, or a frame UUID>'));
+            const t = String(to);
+            let sourceId;
+            if (/^[0-9a-f-]{36}$/.test(t)) {
+              sourceId = t;
+            } else if (t.startsWith('/o/') && t.includes('/projects/')) {
+              // Absolute path — the server mirror route parses it directly.
+              sourceId = t;
+            } else {
+              let dest;
+              try { dest = await resolveProjectsDestination(t); }
+              catch (e) { return err(e); }
+              if (!dest || !dest.meta || !dest.meta.id || dest.rest.length < 2) {
+                return err(new Error('readonly link requires to=/projects/<project>/<layer>/<lane>/<file> or a frame UUID'));
+              }
+              // Scope via header, NOT the query string — api() also appends
+              // projectId for the bound session and two projectId params made
+              // the route resolve both as an array (500).
+              const src = await api('GET', `/api/fs/${dest.rest.join('/')}`, undefined, { ...orgHeader, 'X-Drafted-Project': dest.meta.id });
+              if (!src?.id) return err(new Error(`Source frame not found: ${t}`));
+              sourceId = src.id;
+            }
+            return ok(await api('POST', '/api/fs/link', { mirror: true, from: sourceId }, orgHeader));
+          }
           if (args.url) {
             body.url = args.url;
           } else if (to) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.48",
+  "version": "1.19.51",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [