drafted 1.19.8 → 1.19.11

package/README.md

@@ -18,10 +18,17 @@ Drafted is a native producer and consumer of the **Open Knowledge Format (OKF) v
 **Claude Code, Codex, or any MCP client** — installs the MCP server, the Drafted skill, *and* the eight slash commands (into `~/.claude/commands/drafted/` and `~/.codex/prompts/drafted/`):
 
 ```bash
-curl -fsSL https://drafted.live/install.sh | bash        # macOS / Linux
-irm https://drafted.live/install.ps1 | iex               # Windows
+# macOS / Linux — download, then run the local file:
+curl -fsSL https://drafted.live/install.sh -o /tmp/install-drafted.sh
+bash /tmp/install-drafted.sh
+
+# Windows (PowerShell) — download, then run the local file:
+Invoke-WebRequest https://drafted.live/install.ps1 -OutFile $env:TEMP\drafted-install.ps1
+powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP\drafted-install.ps1
 ```
 
+> **Why not `curl | bash` / `irm | iex`?** Heuristic antivirus (Norton IDP, SmartScreen) flags the pipe-to-shell pattern as download-and-execute malware. Downloading the installer to a local file and running it avoids the false-positive block.
+
 > Adding the MCP server on its own (e.g. `claude mcp add`) gives you the tools without the skill or the commands.
 
 **Claude on the web (claude.ai) and Cowork** — install the plugin, not the bare connector. The plugin bundles the Drafted connector *plus* the Drafted skill and the eight slash commands (`/drafted:onboard-drafted`, `/drafted:create-project`, `/drafted:create-skill`, `/drafted:ingest`, `/drafted:extract`, `/drafted:improve-wiki`, `/drafted:improve-skill`, `/drafted:improve-project-harness`); adding the connector URL on its own gives you the tools with none of the guidance.

package/cli/drafted.mjs

@@ -10,6 +10,7 @@
 import { program } from 'commander';
 import { spawn, execSync, execFileSync } from 'child_process';
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, statSync, unlinkSync, chmodSync } from 'fs';
+import { writeFile } from 'fs/promises';
 import { join, dirname, basename, resolve } from 'path';
 import { homedir, tmpdir, platform } from 'os';
 import { fileURLToPath } from 'url';
@@ -176,11 +177,18 @@ function getServerUrl() {
 function buildUpdateCommand() {
   const server = getServerUrl().replace(/\/$/, '');
   if (platform() === 'win32') {
-    const script = `$tmp = Join-Path $env:TEMP "drafted-install.ps1"; Invoke-WebRequest -UseBasicParsing "${server}/install.ps1" -OutFile $tmp; powershell -NoProfile -ExecutionPolicy Bypass -File $tmp`;
+    // Download the installer with Node, then spawn powershell -File on the LOCAL
+    // copy. Never `powershell -Command "Invoke-WebRequest ...; powershell -File
+    // ..."` — a fetch-and-execute trampoline on the command line is exactly what
+    // heuristic AV (Norton IDP.HEUR) flags as malware.
+    const tmp = path.join(os.tmpdir(), 'drafted-install.ps1');
+    const src = `${server}/install.ps1`;
     return {
       shell: 'powershell.exe',
-      args: ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-Command', script],
-      manualCommand: script,
+      args: ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', tmp],
+      manualCommand: `Invoke-WebRequest -UseBasicParsing "${src}" -OutFile "${tmp}"
+powershell -NoProfile -ExecutionPolicy Bypass -File "${tmp}"`,
+      fetch: { url: src, dest: tmp },
     };
   }
   const script = `tmp=$(mktemp); curl -fsSL ${server}/install.sh -o "$tmp" && bash "$tmp"`;
@@ -505,7 +513,7 @@ program
   .description('Update the npm-installed Drafted MCP daemon')
   .option('--dry-run', 'Print update instructions without starting the updater')
   .option('--yes', 'Start the updater out-of-process')
-  .action((options) => {
+  .action(async (options) => {
     const update = buildUpdateCommand();
     const data = {
       started: false,
@@ -517,6 +525,20 @@ program
     };
 
     if (options.yes && !options.dryRun) {
+      if (update.fetch) {
+        const { url, dest } = update.fetch;
+        try {
+          const resp = await fetch(url);
+          if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
+          await writeFile(dest, Buffer.from(await resp.arrayBuffer()));
+        } catch (err) {
+          console.error(`Could not download the installer: ${err.message}. Run the manual command below instead.`);
+          jsonOut(true, 'update', { ...data, started: false, error: String(err.message || err) });
+          console.log('No automatic update was started. Run the manual updater command:');
+          console.log(`  ${update.manualCommand}`);
+          process.exit(1);
+        }
+      }
       const child = spawn(update.shell, update.args, {
         detached: true,
         stdio: 'ignore',

package/install-mcp.sh

@@ -5,8 +5,9 @@ set -e
 # This script installs the Drafted MCP server and CLI globally via npm,
 # then registers it with Claude Desktop, Claude Code, Codex, and Cursor.
 #
-# Run with:
-#   curl -fsSL https://drafted.live/install.sh | bash
+# Run with (download first, then run the local file):
+#   curl -fsSL https://drafted.live/install.sh -o ~/Downloads/install-drafted.sh
+#   bash ~/Downloads/install-drafted.sh
 
 SERVER="https://drafted.live"
 INSTALLER_VERSION="1"
@@ -1254,7 +1255,7 @@ echo -e "${GREEN}${BOLD}You're all set!${RESET}"
 echo ""
 echo -e "  ${DIM}MCP name:${RESET}  ${BOLD}$INSTALL_NAME${RESET}"
 echo -e "  ${DIM}Server:${RESET}    ${BOLD}$INSTALL_SERVER${RESET}"
-echo -e "  ${DIM}To update production:${RESET}  rerun curl -fsSL https://drafted.live/install.sh | bash"
+echo -e "  ${DIM}To update production:${RESET}  rerun the installer from drafted.live/install (curl -fsSL https://drafted.live/install.sh -o /tmp/install-drafted.sh && bash /tmp/install-drafted.sh)"
 echo -e "  ${DIM}To uninstall:${RESET}  npm uninstall -g drafted --prefix ~/.drafted/npm-global && rm -rf ~/.drafted"
 echo ""
 echo -e "${YELLOW}${BOLD}"

package/mcp/server.mjs

@@ -391,6 +391,7 @@ const TOOL_ANNOTATIONS = {
   session:             { title: 'Session',              readOnlyHint: false, destructiveHint: false, openWorldHint: false, description: 'Name THIS agent session (and rename it later). The name is what the user sees on your surface tab — pick a short 2-3 word description of the work (e.g. "beoflow backend", "drafted fs work"). The name persists across reconnects and restarts; you only set it once unless the work changes. Dispatch by `action`: `name` (set/rename with the `name` param) or `update` (update the npm-installed Drafted MCP on THIS machine when whoami reports mcpUpdate.stale — run it yourself rather than handing the user a shell command; `dryRun` reports without starting it).' },
 
   // Comments — the review loop agents could previously only reach over raw HTTP
+  action:              { title: 'Propose an action',   readOnlyHint: false, destructiveHint: false, openWorldHint: false, description: 'Propose an outward effect for a HUMAN to approve — sharing a project or file, changing someone\'s role, minting a public link, or @mentioning someone in a comment. These are the operations that reach OUTSIDE the org: they grant access to a person or contact them, and they cannot be undone by editing a frame. You can propose and read; you cannot approve. Approving is the send, it happens server-side from a frozen snapshot, and there is no verb here that would let an agent trigger it. Everything INSIDE the org — writing frames, wiki pages, skills, task status — needs no proposal: just do it.' },
   comment:             { title: 'Comments',              readOnlyHint: false, destructiveHint: true,  openWorldHint: false, description: 'Read and write review comments on frames. Comments are notes ABOUT THE WORK: they attach to a frame, optionally to one element inside it, and anyone who can see the frame sees them. Dispatch by `action`: list (paginated, compact mode), add (with an optional element anchor or a reply), resolve, reopen, delete. Use this to leave findings a human can action in place, and to read the feedback they left you.' },
 
   // Canvas / view
@@ -2547,6 +2548,58 @@ tool('tour', {
   } catch (error) { return err(error); }
 });
 
+// ── action: propose an outward effect; a HUMAN approving is what executes ──
+//
+// There is deliberately NO execute/approve verb here, on any transport. The gate
+// is not "the agent may send once approved" — approving IS the send, server-side,
+// from a frozen snapshot. A spendable permission is a capability that can later be
+// re-pointed at content the human never read. See SECURITY.md.
+tool('action', {
+  action: z.enum(['propose', 'list', 'read']).describe('propose: ask a human to authorise one outward effect, or a chain of them approved together. list: your org\'s pending proposals. read: one chain with every payload as the approver will see it.'),
+  type: z.string().optional().describe('[propose] One of: share_project, share_frame, change_share_role, create_public_frame_link, create_public_lane_link, comment_mention. Anything else is refused — the list is fixed in source, not data.'),
+  payload: z.string().optional().describe('[propose] JSON object for this type. share_project {projectId,email,role}; share_frame {frameId,email,role}; change_share_role {shareId,role}; create_public_frame_link {frameId}; create_public_lane_link {projectId,layer,lane}; comment_mention {frameId,body,email}. Optional expiresInHours on the share types.'),
+  actions: z.string().optional().describe('[propose] JSON array of {type,payload} to approve TOGETHER as one chain — e.g. share with three people, then comment tagging them. One screen, one decision. Execution is sequential and stops at the first failure; a sent email cannot be rolled back, so it is never all-or-nothing.'),
+  groupId: z.string().optional().describe('[read] The chain to read.'),
+  reason: z.string().optional().describe('[propose] One line telling the approver WHY. They see it next to what the action does.'),
+  limit: z.number().optional().describe('[list] Default 25.'),
+  offset: z.number().optional().describe('[list] Default 0.'),
+  compact: z.boolean().optional().describe('[list] Identity fields only.'),
+}, async ({ action, type, payload, actions, groupId, reason, limit, offset, compact }) => {
+  try {
+    if (action === 'propose') {
+      let items;
+      if (actions) {
+        const parsed = JSON.parse(actions);
+        if (!Array.isArray(parsed) || !parsed.length) throw new Error('actions must be a non-empty JSON array of {type,payload}');
+        items = parsed;
+      } else {
+        if (!type) throw new Error('type is required for action propose (or pass `actions` for a chain)');
+        items = [{ type, payload: payload ? JSON.parse(payload) : {} }];
+      }
+      const result = await api('POST', '/api/actions', {
+        actions: items,
+        ...(reason ? { reason: String(reason) } : {}),
+      });
+      return ok({
+        ...result,
+        next: 'Proposed. A person must approve this in Drafted before anything is sent — you cannot approve it yourself, and there is no verb here that would let you.',
+      });
+    }
+    if (action === 'read') {
+      if (!groupId) throw new Error('groupId is required for action read');
+      return ok(await api('GET', `/api/actions/groups/${encodeURIComponent(groupId)}`));
+    }
+    const qs = new URLSearchParams();
+    if (limit != null) qs.set('limit', String(limit));
+    if (offset != null) qs.set('offset', String(offset));
+    if (compact) qs.set('compact', '1');
+    const q = qs.toString();
+    return ok(await api('GET', `/api/actions${q ? '?' + q : ''}`));
+  } catch (e) {
+    return err(e);
+  }
+});
+
 tool('comment', {
   action: z.enum(['list', 'add', 'resolve', 'reopen', 'delete']).describe('list: read comments (paginated). add: post a comment or a reply. resolve/reopen: flip a comment\'s state. delete: remove one.'),
   target: z.string().optional().describe('[list, add] The frame: a path (/projects/<project>/<layer>/<lane>/<file>), a frame URL, or a frame UUID. Required for add. For list, omit it to read the whole project.'),
@@ -3808,7 +3861,7 @@ function buildInstalledMcpUpdateInstructions(updateMetadata = null) {
 
   const server = getServerUrl().replace(/\/$/, '');
   const manualCommand = platform() === 'win32'
-    ? `$tmp = Join-Path $env:TEMP "drafted-install.ps1"; Invoke-WebRequest -UseBasicParsing "${server}/install.ps1" -OutFile $tmp; powershell -NoProfile -ExecutionPolicy Bypass -File $tmp`
+    ? `Invoke-WebRequest -UseBasicParsing "${server}/install.ps1" -OutFile "$env:TEMP\drafted-install.ps1"\npowershell -NoProfile -ExecutionPolicy Bypass -File "$env:TEMP\drafted-install.ps1"`
     : `tmp=$(mktemp); curl -fsSL ${server}/install.sh -o "$tmp" && bash "$tmp"`;
 
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.19.8",
+  "version": "1.19.11",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [