drafted 1.8.4 → 1.8.6

package/cli/drafted.mjs

@@ -13,6 +13,7 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, statSy
 import { join, dirname, basename, resolve } from 'path';
 import { homedir, tmpdir, platform } from 'os';
 import { fileURLToPath } from 'url';
+import { createHash } from 'node:crypto';
 import { DESIGN_SYSTEM_PROMPT, buildDesignPrompt } from './prompts.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
@@ -1188,4 +1189,247 @@ program
     console.log('Restart Claude Code for changes to take effect.');
   });
 
+// ── skill: Causeway sync seam ────────────────────────────────────
+// Materialize pinned skills into a local cache dir so Causeway can project them
+// into agents and run their bundled scripts. The Causeway daemon shells out here
+// so it never holds Drafted's session token. Contract (in the causeway repo):
+// docs/contracts/drafted-skill-sync.md.
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+// synthesizeSkillMd builds a self-describing SKILL.md. Drafted stores `content`
+// as the body only (name/description/triggerPatterns are columns), so we prepend
+// YAML frontmatter — JSON scalars are valid YAML — for Causeway's projection and
+// Claude's native loader to read.
+function synthesizeSkillMd(skill) {
+  const lines = ['---', `name: ${JSON.stringify(skill.name || skill.slug || '')}`];
+  if (skill.description) lines.push(`description: ${JSON.stringify(skill.description)}`);
+  const triggers = Array.isArray(skill.triggerPatterns) ? skill.triggerPatterns.filter(Boolean) : [];
+  if (triggers.length) {
+    lines.push('triggerPatterns:');
+    for (const t of triggers) lines.push(`  - ${JSON.stringify(t)}`);
+  }
+  lines.push('---', '');
+  return lines.join('\n') + (skill.content || '');
+}
+
+// bundleHash is a stable content hash over the bundle (sorted path\0content\0),
+// so the same content yields the same hash regardless of cosmetic re-saves.
+// Drafted is the hash authority; this value is what a pin stores.
+function bundleHash(files) {
+  const h = createHash('sha256');
+  for (const p of Object.keys(files).sort()) {
+    h.update(p); h.update('\0'); h.update(files[p]); h.update('\0');
+  }
+  return h.digest('hex').slice(0, 12);
+}
+
+// Build an `unresolvable` reason from a failed resolve response (404/403),
+// naming the org when --org was used so Causeway can render `✗ unresolvable
+// (org X)` instead of a silent miss.
+async function unresolvableReason(res, org) {
+  let why = 'skill not found';
+  try { const e = await res.json(); if (e && e.error) why = e.error; } catch { /* keep default */ }
+  if (org && !why.toLowerCase().includes(String(org).toLowerCase())) return `${why} (org ${org})`;
+  return why;
+}
+
+async function syncOneSkill(ref, outDir, org) {
+  const at = ref.lastIndexOf('@');
+  const idOrSlug = at > 0 ? ref.slice(0, at) : ref;
+  const server = getServerUrl().replace(/\/$/, '');
+  // --org binds resolution to a specific org per-request (X-Drafted-Org header);
+  // the server validates it against the caller's memberships and never mutates
+  // the shared session's active org. Omitted -> ambient session org (unchanged).
+  const orgHeaders = org ? { 'X-Drafted-Org': org } : {};
+  const loadUrl = UUID_RE.test(idOrSlug)
+    ? `${server}/api/skills/${idOrSlug}`
+    : `${server}/api/skills/slug/${encodeURIComponent(idOrSlug)}`;
+  const res = await authFetch(loadUrl, { headers: orgHeaders });
+  if (res.status === 404 || res.status === 403) return { ref, slug: '', hash: '', status: 'unresolvable', error: await unresolvableReason(res, org) };
+  if (!res.ok) return { ref, slug: '', hash: '', status: 'error', error: `HTTP ${res.status}` };
+  const skill = await res.json();
+  const slug = skill.slug || idOrSlug;
+
+  const files = { 'SKILL.md': synthesizeSkillMd(skill) };
+  for (const p of Array.isArray(skill.files) ? skill.files : []) {
+    if (typeof p !== 'string' || p.includes('..')) continue;
+    const encoded = p.split('/').map(encodeURIComponent).join('/');
+    const fr = await authFetch(`${server}/api/skills/${skill.id}/files/${encoded}`, { headers: orgHeaders });
+    if (!fr.ok) return { ref, slug, hash: '', status: 'error', error: `file ${p}: HTTP ${fr.status}` };
+    const fdata = await fr.json();
+    files[p] = typeof fdata === 'string' ? fdata : (fdata.content || '');
+  }
+  const hash = bundleHash(files);
+
+  const base = join(outDir, slug);
+  for (const [rel, content] of Object.entries(files)) {
+    const full = join(base, rel);
+    mkdirSync(dirname(full), { recursive: true });
+    writeFileSync(full, content);
+  }
+  return { ref, slug, hash, status: 'ok' };
+}
+
+const skillCmd = program.command('skill').description('Skill library operations');
+skillCmd
+  .command('sync')
+  .description('Materialize pinned skills into a local cache dir (Causeway seam)')
+  .option('--ref <ref>', 'skill ref slug[@hash] (repeatable)', (v, acc) => { acc.push(v); return acc; }, [])
+  .requiredOption('--out <dir>', 'output directory for bundles')
+  .option('--org <org>', 'resolve against this Drafted org (id or name); scopes per-request without switching the session')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    requireLogin();
+    const refs = opts.ref || [];
+    mkdirSync(opts.out, { recursive: true });
+    const results = [];
+    let allOk = refs.length > 0;
+    for (const ref of refs) {
+      try {
+        const r = await syncOneSkill(ref, opts.out, opts.org);
+        results.push(r);
+        if (r.status !== 'ok') allOk = false;
+      } catch (err) {
+        results.push({ ref, slug: '', hash: '', status: 'error', error: String((err && err.message) || err) });
+        allOk = false;
+      }
+    }
+    if (opts.format === 'json') {
+      console.log(JSON.stringify(results));
+    } else {
+      for (const r of results) {
+        console.log(`${r.status}\t${r.ref}\t${r.slug}\t${r.hash}${r.error ? '\t' + r.error : ''}`);
+      }
+    }
+    process.exit(allOk ? 0 : 1);
+  });
+
+// ── skill mutations: Causeway write seam ─────────────────────────
+// add/update/remove mirror the sync seam so the Causeway daemon can create and
+// improve reusable skills without holding Drafted's token. Each reads its payload
+// from stdin JSON and prints a {slug,id,hash,status} result line.
+function readStdinJSON() {
+  let raw = '';
+  try { raw = readFileSync(0, 'utf8'); } catch { raw = ''; }
+  raw = raw.trim();
+  if (!raw) return {};
+  return JSON.parse(raw);
+}
+
+function emitSkillResult(format, obj) {
+  if (format === 'json') { console.log(JSON.stringify(obj)); return; }
+  console.log([obj.status, obj.slug || '', obj.id || '', obj.hash || '', obj.error || ''].join('\t'));
+}
+
+skillCmd
+  .command('add')
+  .description('Create a skill in Drafted from stdin JSON {name,description,content,tags?,triggerPatterns?}')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    requireLogin();
+    let p;
+    try { p = readStdinJSON(); } catch { console.error('invalid JSON on stdin'); process.exit(1); }
+    const server = getServerUrl().replace(/\/$/, '');
+    const res = await authFetch(`${server}/api/skills`, {
+      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: p.name, description: p.description, content: p.content, tags: p.tags, triggerPatterns: p.triggerPatterns }),
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      emitSkillResult(opts.format, { status: res.status === 409 ? 'conflict' : 'error', error: data.error || `HTTP ${res.status}` });
+      process.exit(1);
+    }
+    emitSkillResult(opts.format, { status: 'ok', slug: data.slug, id: data.id, hash: bundleHash({ 'SKILL.md': synthesizeSkillMd(data) }) });
+  });
+
+skillCmd
+  .command('update')
+  .description('Update a Drafted skill (--id or --slug) from stdin JSON {description?,content?,triggerPatterns?,tags?}')
+  .option('--id <id>', 'skill id')
+  .option('--slug <slug>', 'skill slug (resolved to id)')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    requireLogin();
+    let p;
+    try { p = readStdinJSON(); } catch { console.error('invalid JSON on stdin'); process.exit(1); }
+    const server = getServerUrl().replace(/\/$/, '');
+    let id = opts.id;
+    if (!id && opts.slug) {
+      const lookup = await authFetch(`${server}/api/skills/slug/${encodeURIComponent(opts.slug)}`);
+      if (!lookup.ok) { emitSkillResult(opts.format, { status: 'unresolvable', error: `slug ${opts.slug}: HTTP ${lookup.status}` }); process.exit(1); }
+      id = (await lookup.json().catch(() => ({}))).id;
+    }
+    if (!id) { emitSkillResult(opts.format, { status: 'error', error: 'update requires --id or --slug' }); process.exit(1); }
+    const res = await authFetch(`${server}/api/skills/${id}`, {
+      method: 'PUT', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: p.name, description: p.description, content: p.content, tags: p.tags, triggerPatterns: p.triggerPatterns }),
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      emitSkillResult(opts.format, { status: res.status === 404 ? 'unresolvable' : 'error', error: data.error || `HTTP ${res.status}` });
+      process.exit(1);
+    }
+    emitSkillResult(opts.format, { status: 'ok', slug: data.slug, id: data.id, hash: bundleHash({ 'SKILL.md': synthesizeSkillMd(data) }) });
+  });
+
+// check reports the current canonical hash for refs WITHOUT materializing — the
+// Causeway freshness probe. Hash is computed the same way as sync, so a check
+// hash and a sync hash for the same skill match.
+async function checkOneSkill(ref, org) {
+  const at = ref.lastIndexOf('@');
+  const idOrSlug = at > 0 ? ref.slice(0, at) : ref;
+  const server = getServerUrl().replace(/\/$/, '');
+  const orgHeaders = org ? { 'X-Drafted-Org': org } : {};
+  const loadUrl = UUID_RE.test(idOrSlug)
+    ? `${server}/api/skills/${idOrSlug}`
+    : `${server}/api/skills/slug/${encodeURIComponent(idOrSlug)}`;
+  const res = await authFetch(loadUrl, { headers: orgHeaders });
+  if (res.status === 404 || res.status === 403) return { ref, slug: '', hash: '', status: 'unresolvable', error: await unresolvableReason(res, org) };
+  if (!res.ok) return { ref, slug: '', hash: '', status: 'error', error: `HTTP ${res.status}` };
+  const skill = await res.json();
+  const files = { 'SKILL.md': synthesizeSkillMd(skill) };
+  for (const p of Array.isArray(skill.files) ? skill.files : []) {
+    if (typeof p !== 'string' || p.includes('..')) continue;
+    const fr = await authFetch(`${server}/api/skills/${skill.id}/files/${p.split('/').map(encodeURIComponent).join('/')}`, { headers: orgHeaders });
+    if (!fr.ok) return { ref, slug: skill.slug, hash: '', status: 'error', error: `file ${p}: HTTP ${fr.status}` };
+    const fdata = await fr.json();
+    files[p] = typeof fdata === 'string' ? fdata : (fdata.content || '');
+  }
+  return { ref, slug: skill.slug, hash: bundleHash(files), status: 'ok', updatedAt: skill.updatedAt };
+}
+
+skillCmd
+  .command('check')
+  .description('Report the current canonical hash for refs without materializing (freshness)')
+  .option('--ref <ref>', 'skill ref (repeatable)', (v, acc) => { acc.push(v); return acc; }, [])
+  .option('--org <org>', 'resolve against this Drafted org (id or name); scopes per-request without switching the session')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    requireLogin();
+    const results = [];
+    for (const ref of (opts.ref || [])) {
+      try { results.push(await checkOneSkill(ref, opts.org)); }
+      catch (e) { results.push({ ref, slug: '', hash: '', status: 'error', error: String((e && e.message) || e) }); }
+    }
+    if (opts.format === 'json') console.log(JSON.stringify(results));
+    else for (const r of results) console.log(`${r.status}\t${r.ref}\t${r.slug}\t${r.hash}`);
+  });
+
+skillCmd
+  .command('remove')
+  .description('Delete a Drafted skill by --id (used to clean up throwaway skills)')
+  .requiredOption('--id <id>', 'skill id')
+  .option('--format <fmt>', 'output format: json or text', 'text')
+  .action(async (opts) => {
+    requireLogin();
+    const server = getServerUrl().replace(/\/$/, '');
+    const res = await authFetch(`${server}/api/skills/${opts.id}`, { method: 'DELETE' });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      emitSkillResult(opts.format, { status: 'error', id: opts.id, error: data.error || `HTTP ${res.status}` });
+      process.exit(1);
+    }
+    emitSkillResult(opts.format, { status: 'ok', id: opts.id });
+  });
+
 program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.8.4",
+  "version": "1.8.6",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [