drafted 1.19.49 → 1.19.51

package/install-mcp.sh

@@ -550,47 +550,93 @@ else
   PLUGIN_SRC=""
 fi
 
+# Skills and commands are LINKED, never copied: a copy is a point-in-time snapshot that only
+# refreshes when someone re-runs this installer, so `npm i -g drafted@latest` would leave the
+# installed skill silently behind the package it came from. A link tracks the upgrade.
+#
+# link_plugin_entry is idempotent and non-destructive: a correct link is left alone, a wrong or
+# dangling one is repointed, and a real file/directory (which the user may have written by hand)
+# is moved aside rather than deleted. Backups go OUTSIDE the skills/commands dirs — a
+# `drafted.backup/` sitting next to `drafted/` would register as a second, stale skill.
+DRAFTED_BACKUP_DIR="$HOME/.claude/.drafted-backups"
+link_plugin_entry() {
+  local source="$1" target="$2" source_real backup
+  source_real="$(cd "$(dirname "$source")" && pwd)/$(basename "$source")"
+  if [ -L "$target" ]; then
+    if [ "$(readlink "$target")" = "$source_real" ]; then return 0; fi
+    rm -f "$target"
+  elif [ -e "$target" ]; then
+    # Byte-identical to the source: this is a prior copy-install of ours, not user content, and
+    # the link reproduces it losslessly. Anything else is backed up.
+    if diff -rq "$source_real" "$target" >/dev/null 2>&1; then
+      rm -rf "$target"
+    else
+      mkdir -p "$DRAFTED_BACKUP_DIR"
+      backup="$DRAFTED_BACKUP_DIR/$(basename "$target").$(date +%Y%m%d%H%M%S)"
+      mv "$target" "$backup"
+      echo -e "    ${YELLOW}Existing $(basename "$target") moved aside → $backup${RESET}"
+    fi
+  fi
+  ln -s "$source_real" "$target"
+}
+
+# Remove links WE made whose source is gone — an entry dropped from the package, or the package
+# uninstalled entirely. A dangling skill dir is worse than a stale one: it looks installed and
+# loads nothing. Matched on the link's own target path so other installers' links are untouched.
+sweep_plugin_links() {
+  local dir="$1" marker="$2" link
+  [ -d "$dir" ] || return 0
+  while IFS= read -r link; do
+    case "$(readlink "$link")" in
+      *"$marker"*)
+        if [ ! -e "$link" ]; then
+          rm -f "$link"
+          echo -e "    ${YELLOW}Removed stale link: $(basename "$link")${RESET}"
+        fi
+        ;;
+    esac
+  done < <(find "$dir" -maxdepth 1 -type l 2>/dev/null)
+}
+
 # Skills — Claude Code auto-loads these from ~/.claude/skills/<name>/SKILL.md
+SKILLS_DIR="$HOME/.claude/skills"
+sweep_plugin_links "$SKILLS_DIR" "/plugin/skills/"
 if [ -n "$PLUGIN_SRC" ] && [ -d "$PLUGIN_SRC/skills" ]; then
-  SKILLS_DIR="$HOME/.claude/skills"
   mkdir -p "$SKILLS_DIR"
   SKILL_COUNT=0
   for d in "$PLUGIN_SRC/skills/"*/; do
     [ -d "$d" ] || continue
     DIRNAME="$(basename "$d")"
-    rm -rf "$SKILLS_DIR/$DIRNAME"
-    cp -r "$d" "$SKILLS_DIR/$DIRNAME"
+    link_plugin_entry "${d%/}" "$SKILLS_DIR/$DIRNAME"
     SKILL_COUNT=$((SKILL_COUNT + 1))
   done
-  ok "Installed $SKILL_COUNT skill(s) to $SKILLS_DIR"
+  ok "Linked $SKILL_COUNT skill(s) into $SKILLS_DIR (source: $PLUGIN_SRC/skills)"
 else
   echo -e "    ${YELLOW}Skill source not found in package — skipping skills.${RESET}"
 fi
 
 # Commands — namespaced under drafted/ so they register as /drafted:<name>,
-# matching the marketplace install and the commands' own cross-references.
+# matching the marketplace install and the commands' own cross-references. Linked per FILE into a
+# real directory (not a linked directory) so discovery is unchanged; the containing dir is no
+# longer rm -rf'd, so anything else a user put there survives.
+CLAUDE_CMD_DIR="$HOME/.claude/commands/drafted"
+CODEX_CMD_DIR="$HOME/.codex/prompts/drafted"
+sweep_plugin_links "$CLAUDE_CMD_DIR" "/plugin/commands/"
+sweep_plugin_links "$CODEX_CMD_DIR" "/plugin/commands/"
 if [ -n "$PLUGIN_SRC" ] && [ -d "$PLUGIN_SRC/commands" ]; then
-  CMD_COUNT=0
-  for f in "$PLUGIN_SRC/commands/"*.md; do
-    [ -f "$f" ] || continue
-    CMD_COUNT=$((CMD_COUNT + 1))
-  done
-
-  if [ "$CLIENT_CLAUDE_CODE" = true ]; then
-    CLAUDE_CMD_DIR="$HOME/.claude/commands/drafted"
-    rm -rf "$CLAUDE_CMD_DIR"
-    mkdir -p "$CLAUDE_CMD_DIR"
-    cp "$PLUGIN_SRC/commands/"*.md "$CLAUDE_CMD_DIR/" 2>/dev/null || true
-    ok "Installed $CMD_COUNT command(s) to $CLAUDE_CMD_DIR"
-  fi
+  link_commands_into() {
+    local dest="$1" count=0 f
+    mkdir -p "$dest"
+    for f in "$PLUGIN_SRC/commands/"*.md; do
+      [ -f "$f" ] || continue
+      link_plugin_entry "$f" "$dest/$(basename "$f")"
+      count=$((count + 1))
+    done
+    ok "Linked $count command(s) into $dest"
+  }
 
-  if [ "$CLIENT_CODEX" = true ]; then
-    CODEX_CMD_DIR="$HOME/.codex/prompts/drafted"
-    rm -rf "$CODEX_CMD_DIR"
-    mkdir -p "$CODEX_CMD_DIR"
-    cp "$PLUGIN_SRC/commands/"*.md "$CODEX_CMD_DIR/" 2>/dev/null || true
-    ok "Installed $CMD_COUNT command(s) to $CODEX_CMD_DIR"
-  fi
+  if [ "$CLIENT_CLAUDE_CODE" = true ]; then link_commands_into "$CLAUDE_CMD_DIR"; fi
+  if [ "$CLIENT_CODEX" = true ]; then link_commands_into "$CODEX_CMD_DIR"; fi
 else
   echo -e "    ${YELLOW}Command source not found in package — skipping commands.${RESET}"
 fi

package/mcp/server.mjs

@@ -4235,7 +4235,10 @@ tool('fs', 'Navigate Drafted like a local filesystem. A FOLDER is the single con
               if (!dest || !dest.meta || !dest.meta.id || dest.rest.length < 2) {
                 return err(new Error('readonly link requires to=/projects/<project>/<layer>/<lane>/<file> or a frame UUID'));
               }
-              const src = await api('GET', `/api/fs/${dest.rest.join('/')}?projectId=${dest.meta.id}`, undefined, orgHeader);
+              // Scope via header, NOT the query string — api() also appends
+              // projectId for the bound session and two projectId params made
+              // the route resolve both as an array (500).
+              const src = await api('GET', `/api/fs/${dest.rest.join('/')}`, undefined, { ...orgHeader, 'X-Drafted-Project': dest.meta.id });
               if (!src?.id) return err(new Error(`Source frame not found: ${t}`));
               sourceId = src.id;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.49",
+  "version": "1.19.51",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [