drafted 1.7.25 → 1.7.26

package/mcp/server.mjs

@@ -614,34 +614,50 @@ function schedulePendingAuthPoll(delayMs = 2000) {
   if (typeof pendingAuthPollTimer.unref === 'function') pendingAuthPollTimer.unref();
 }
 
+// Cookie for normal tool operations. Deliberately uses ONLY this instance's
+// per-process session (getState().sessionId) and never the shared root login in
+// ~/.drafted/auth.json. The root is a *credential for minting child sessions*
+// (see cloneSession): every agent process on the machine reads the same root, so
+// operating on it directly is exactly what let one agent's get_org switch move
+// every other agent's active org. ensureSession() guarantees a per-instance
+// session before any operation runs.
 function getAuthHeaders() {
-  const sid = getState().sessionId || getBootstrapSessionId();
+  const sid = getState().sessionId;
   if (sid) return { Cookie: `gc_session=${sid}` };
   return {};
 }
 
+// Mint a fresh per-instance child session from the shared root login and bind it
+// to this process. The root session id (getBootstrapSessionId) is shared by every
+// agent on this machine via ~/.drafted/auth.json; the clone gives THIS process its
+// own server-side session so its active org/project stay isolated from other
+// agents. Returns true once a per-instance session is set.
 async function cloneSession() {
+  if (getState().sessionId) return true;
   const bootstrapId = getBootstrapSessionId();
-  if (!bootstrapId) return;
+  if (!bootstrapId) return false;
 
   try {
-    const url = `${getServerUrl()}/auth/session/clone`;
-    const res = await fetch(url, {
+    const res = await fetch(`${getServerUrl()}/auth/session/clone`, {
       method: 'POST',
       headers: { Cookie: `gc_session=${bootstrapId}` },
     });
-    if (!res.ok) return;
-    const data = await res.json();
-    if (data.sessionId) {
-      getState().sessionId = data.sessionId;
+    if (res.ok) {
+      const data = await res.json();
+      if (data.sessionId) {
+        getState().sessionId = data.sessionId;
+        return true;
+      }
     }
-  } catch { /* server may not be ready yet, will retry on first API call */ }
+  } catch { /* server may not be ready yet; caller retries on next API call */ }
+  return false;
 }
 
 async function ensureSession() {
   if (getState().sessionId) return;
-  await consumePendingDeviceCode();
-  if (getState().sessionId) return;
+  // A pending device-code login (from `auth get_link`) takes priority; consuming
+  // it mints this instance's own session. Otherwise clone the saved root login.
+  if (await consumePendingDeviceCode()) return;
   await cloneSession();
 }
 
@@ -1130,10 +1146,14 @@ async function consumePendingDeviceCode() {
     if (!res.ok) return false;
     const data = await res.json();
     if (data.status === 'approved' && data.sessionId) {
+      // data.sessionId is the shared ROOT login. Persist it as the machine-level
+      // credential, then mint our OWN per-instance child session from it (mirrors
+      // the `auth login` tool) so this process never operates on the shared root.
       persistAuthSession(data);
-      getState().sessionId = data.sessionId;
       clearPendingDeviceCode();
-      return true;
+      getState().sessionId = null;
+      await cloneSession();
+      return !!getState().sessionId;
     }
     if (data.status === 'expired') {
       clearPendingDeviceCode();
@@ -1468,6 +1488,7 @@ tool('screenshot', 'Render a PNG via headless browser. `scope=frame` captures a
         frameId = frame.id;
       }
       const url = `${getServerUrl()}/api/screenshot/${frameId}?width=${width}&height=${height}&fullPage=${fullPage}`;
+      await ensureSession();
       const res = await fetch(url, { headers: getAuthHeaders() });
       if (!res.ok) throw new Error(`Screenshot failed: ${res.status}`);
       const buffer = await res.arrayBuffer();
@@ -1486,6 +1507,7 @@ tool('screenshot', 'Render a PNG via headless browser. `scope=frame` captures a
         targetSlug = active.slug;
       }
       const url = `${getServerUrl()}/api/canvas-screenshot/${encodeURIComponent(targetSlug)}?layer=${encodeURIComponent(layer)}&width=${width}&height=${height}`;
+      await ensureSession();
       const res = await fetch(url, { headers: getAuthHeaders() });
       if (!res.ok) throw new Error(`Canvas screenshot failed: ${res.status} ${await res.text()}`);
       const buffer = await res.arrayBuffer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.7.25",
+  "version": "1.7.26",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [