drafted 1.22.3 → 1.22.5

package/install-mcp.sh

@@ -712,6 +712,9 @@ retire_legacy_updater() {
 # Returns 0 ONLY when a valid Drafted.app is present afterward, so the caller can safely
 # retire the legacy updater. Returns 1 when no new bundle is available yet — the caller then
 # falls back to building the legacy Swift updater, so users are never left without a tray.
+# Developer ID Application: Beoflow B.V. (2D9Q24N9UQ) — the identity desktop/RELEASE.md signs with.
+DESKTOP_SIGNING_REQUIREMENT='anchor apple generic and certificate leaf[subject.OU] = "2D9Q24N9UQ"'
+
 install_desktop_app() {
   local install_dir app_bundle app_exe uid plist tmp tarball url
   install_dir="/Applications"
@@ -729,9 +732,18 @@ install_desktop_app() {
     url="${DRAFTED_DESKTOP_URL:-$INSTALL_SERVER/desktop/Drafted-macos.tar.gz}"
     tmp="$(mktemp -d)"
     tarball="$tmp/Drafted-macos.tar.gz"
-    if curl -fsSL --max-time 120 "$url" -o "$tarball" >/dev/null 2>&1; then
-      rm -rf "$app_bundle" >/dev/null 2>&1 || true
-      tar -xzf "$tarball" -C "$install_dir" >/dev/null 2>&1 || true
+    if curl -fsSL --max-time 120 "$url" -o "$tarball" >/dev/null 2>&1 \
+      && mkdir -p "$tmp/x" && tar -xzf "$tarball" -C "$tmp/x" >/dev/null 2>&1; then
+      # Quarantine is stripped below, so Gatekeeper never checks this bundle: check it
+      # here. It must carry an intact Developer ID signature from OUR team; a tampered
+      # or re-signed (e.g. ad-hoc) bundle is refused and the installed app is kept
+      # (audit 2026-10-13).
+      if codesign --verify --deep --strict -R="$DESKTOP_SIGNING_REQUIREMENT" "$tmp/x/Drafted.app" >/dev/null 2>&1; then
+        rm -rf "$app_bundle" >/dev/null 2>&1 || true
+        mv "$tmp/x/Drafted.app" "$app_bundle" >/dev/null 2>&1 || true
+      else
+        echo -e "    ${YELLOW}Desktop app download failed its signature check; not installing it.${RESET}"
+      fi
     fi
     rm -rf "$tmp" >/dev/null 2>&1 || true
   fi

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "drafted",
-  "version": "1.22.3",
+  "version": "1.22.5",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
+  "bin": {
+    "drafted": "./cli/drafted.mjs",
+    "drafted-mcp": "./mcp/server.mjs"
+  },
   "files": [
     "cli/",
     "mcp/",
@@ -13,100 +17,28 @@
     "plugin/commands/",
     "install-mcp.sh"
   ],
-  "bin": {
-    "drafted": "./cli/drafted.mjs",
-    "drafted-mcp": "./mcp/server.mjs"
-  },
-  "scripts": {
-    "dev": "./dev.sh",
-    "dev:server": "tsx watch --import ./server/instrument.mjs server/server.mjs",
-    "dev:local": "node server/server-local.mjs",
-    "install-global": "npm install -g .",
-    "db:migrate": "psql $DATABASE_URL -f drizzle/migrate.sql",
-    "db:push": "drizzle-kit push",
-    "db:studio": "drizzle-kit studio",
-    "migrate-fs": "tsx server/migrate-fs.ts",
-    "db:clean-sessions": "tsx src/auth/cleanup.ts",
-    "import:legacy": "tsx scripts/import-legacy.mts",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "version": "node scripts/sync-versions.mjs && git add plugin/.claude-plugin/plugin.json .claude-plugin/marketplace.json web-plugin/plugin/.claude-plugin/plugin.json web-plugin/.claude-plugin/marketplace.json",
-    "version:check": "node scripts/sync-versions.mjs",
-    "postpublish": "bash scripts/sync-plugin.sh \"chore: sync plugin to v$npm_package_version\" && bash scripts/sync-web-plugin.sh \"chore: sync web-plugin to v$npm_package_version\"",
-    "deploy:check:google": "node scripts/check-google-drive-deploy.mjs",
-    "build:excalidraw": "node scripts/build-excalidraw-editor.mjs",
-    "build:office-viewer": "node scripts/build-office-viewer.mjs",
-    "prepublishOnly": "node scripts/check-npm-package.mjs",
-    "test:marketing": "node server/lib/marketing/test-marketing.mjs"
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ddfourtwo/drafted.git"
   },
+  "keywords": [
+    "design",
+    "canvas",
+    "preview",
+    "html",
+    "claude"
+  ],
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1007.0",
-    "@aws-sdk/s3-request-presigner": "^3.1008.0",
-    "@clerk/backend": "^3.2.12",
-    "@clerk/express": "^2.1.4",
-    "@clerk/mcp-tools": "^0.3.1",
-    "@excalidraw/excalidraw": "^0.18.1",
     "@modelcontextprotocol/ext-apps": "^1.6.0",
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@sentry/browser": "^10.53.1",
-    "@sentry/node": "^10.53.1",
-    "@xmldom/xmldom": "^0.9.10",
     "commander": "^11.1.0",
-    "dagre": "^0.8.5",
-    "docx": "^9.7.1",
-    "dotenv": "^17.3.1",
-    "drizzle-orm": "^0.45.1",
-    "esbuild": "^0.28.0",
-    "exceljs": "^4.4.0",
-    "express": "^4.18.2",
-    "jszip": "^3.10.1",
-    "lucide": "^1.16.0",
-    "mdast-util-from-markdown": "^2.0.3",
-    "multer": "^2.1.1",
-    "nodemailer": "^10.0.13",
-    "parse5": "^8.0.1",
-    "pg": "^8.20.0",
-    "playwright": "^1.58.2",
-    "puppeteer": "^25.12.0",
     "qrcode-terminal": "^0.12.0",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
-    "sharp": "^0.35.5",
     "ws": "^8.21.3",
     "yaml": "^2.8.3",
     "zod": "^4.3.6"
   },
-  "overrides": {
-    "@excalidraw/excalidraw": {
-      "nanoid": "^3.3.19"
-    },
-    "@excalidraw/mermaid-to-excalidraw": {
-      "nanoid": "^5.1.16"
-    },
-    "immutable": "^4.3.9",
-    "lodash-es": "^4.18.1"
-  },
-  "keywords": [
-    "design",
-    "canvas",
-    "preview",
-    "html",
-    "claude"
-  ],
-  "author": "ddfourtwo",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ddfourtwo/drafted.git"
-  },
-  "license": "MIT",
-  "devDependencies": {
-    "@types/express": "^5.0.6",
-    "@types/nodemailer": "^7.0.11",
-    "@types/pg": "^8.18.0",
-    "docx-preview": "^0.3.7",
-    "drizzle-kit": "^0.31.9",
-    "tsx": "^4.19.0",
-    "typescript": "^5.9.3",
-    "vitest": "^3.2.4"
+  "scripts": {
+    "postpublish": "bash ../scripts/sync-plugin.sh \"chore: sync plugin to v$npm_package_version\" && bash ../scripts/sync-web-plugin.sh \"chore: sync web-plugin to v$npm_package_version\""
   }
 }