drafted 1.8.5 → 1.8.6

package/cli/drafted.mjs

@@ -1223,15 +1223,29 @@ function bundleHash(files) {
   return h.digest('hex').slice(0, 12);
 }
 
-async function syncOneSkill(ref, outDir) {
+// Build an `unresolvable` reason from a failed resolve response (404/403),
+// naming the org when --org was used so Causeway can render `✗ unresolvable
+// (org X)` instead of a silent miss.
+async function unresolvableReason(res, org) {
+  let why = 'skill not found';
+  try { const e = await res.json(); if (e && e.error) why = e.error; } catch { /* keep default */ }
+  if (org && !why.toLowerCase().includes(String(org).toLowerCase())) return `${why} (org ${org})`;
+  return why;
+}
+
+async function syncOneSkill(ref, outDir, org) {
   const at = ref.lastIndexOf('@');
   const idOrSlug = at > 0 ? ref.slice(0, at) : ref;
   const server = getServerUrl().replace(/\/$/, '');
+  // --org binds resolution to a specific org per-request (X-Drafted-Org header);
+  // the server validates it against the caller's memberships and never mutates
+  // the shared session's active org. Omitted -> ambient session org (unchanged).
+  const orgHeaders = org ? { 'X-Drafted-Org': org } : {};
   const loadUrl = UUID_RE.test(idOrSlug)
     ? `${server}/api/skills/${idOrSlug}`
     : `${server}/api/skills/slug/${encodeURIComponent(idOrSlug)}`;
-  const res = await authFetch(loadUrl);
-  if (res.status === 404) return { ref, slug: '', hash: '', status: 'unresolvable', error: 'skill not found' };
+  const res = await authFetch(loadUrl, { headers: orgHeaders });
+  if (res.status === 404 || res.status === 403) return { ref, slug: '', hash: '', status: 'unresolvable', error: await unresolvableReason(res, org) };
   if (!res.ok) return { ref, slug: '', hash: '', status: 'error', error: `HTTP ${res.status}` };
   const skill = await res.json();
   const slug = skill.slug || idOrSlug;
@@ -1240,7 +1254,7 @@ async function syncOneSkill(ref, outDir) {
   for (const p of Array.isArray(skill.files) ? skill.files : []) {
     if (typeof p !== 'string' || p.includes('..')) continue;
     const encoded = p.split('/').map(encodeURIComponent).join('/');
-    const fr = await authFetch(`${server}/api/skills/${skill.id}/files/${encoded}`);
+    const fr = await authFetch(`${server}/api/skills/${skill.id}/files/${encoded}`, { headers: orgHeaders });
     if (!fr.ok) return { ref, slug, hash: '', status: 'error', error: `file ${p}: HTTP ${fr.status}` };
     const fdata = await fr.json();
     files[p] = typeof fdata === 'string' ? fdata : (fdata.content || '');
@@ -1262,6 +1276,7 @@ skillCmd
   .description('Materialize pinned skills into a local cache dir (Causeway seam)')
   .option('--ref <ref>', 'skill ref slug[@hash] (repeatable)', (v, acc) => { acc.push(v); return acc; }, [])
   .requiredOption('--out <dir>', 'output directory for bundles')
+  .option('--org <org>', 'resolve against this Drafted org (id or name); scopes per-request without switching the session')
   .option('--format <fmt>', 'output format: json or text', 'text')
   .action(async (opts) => {
     requireLogin();
@@ -1271,7 +1286,7 @@ skillCmd
     let allOk = refs.length > 0;
     for (const ref of refs) {
       try {
-        const r = await syncOneSkill(ref, opts.out);
+        const r = await syncOneSkill(ref, opts.out, opts.org);
         results.push(r);
         if (r.status !== 'ok') allOk = false;
       } catch (err) {
@@ -1360,21 +1375,22 @@ skillCmd
 // check reports the current canonical hash for refs WITHOUT materializing — the
 // Causeway freshness probe. Hash is computed the same way as sync, so a check
 // hash and a sync hash for the same skill match.
-async function checkOneSkill(ref) {
+async function checkOneSkill(ref, org) {
   const at = ref.lastIndexOf('@');
   const idOrSlug = at > 0 ? ref.slice(0, at) : ref;
   const server = getServerUrl().replace(/\/$/, '');
+  const orgHeaders = org ? { 'X-Drafted-Org': org } : {};
   const loadUrl = UUID_RE.test(idOrSlug)
     ? `${server}/api/skills/${idOrSlug}`
     : `${server}/api/skills/slug/${encodeURIComponent(idOrSlug)}`;
-  const res = await authFetch(loadUrl);
-  if (res.status === 404) return { ref, slug: '', hash: '', status: 'unresolvable' };
+  const res = await authFetch(loadUrl, { headers: orgHeaders });
+  if (res.status === 404 || res.status === 403) return { ref, slug: '', hash: '', status: 'unresolvable', error: await unresolvableReason(res, org) };
   if (!res.ok) return { ref, slug: '', hash: '', status: 'error', error: `HTTP ${res.status}` };
   const skill = await res.json();
   const files = { 'SKILL.md': synthesizeSkillMd(skill) };
   for (const p of Array.isArray(skill.files) ? skill.files : []) {
     if (typeof p !== 'string' || p.includes('..')) continue;
-    const fr = await authFetch(`${server}/api/skills/${skill.id}/files/${p.split('/').map(encodeURIComponent).join('/')}`);
+    const fr = await authFetch(`${server}/api/skills/${skill.id}/files/${p.split('/').map(encodeURIComponent).join('/')}`, { headers: orgHeaders });
     if (!fr.ok) return { ref, slug: skill.slug, hash: '', status: 'error', error: `file ${p}: HTTP ${fr.status}` };
     const fdata = await fr.json();
     files[p] = typeof fdata === 'string' ? fdata : (fdata.content || '');
@@ -1386,12 +1402,13 @@ skillCmd
   .command('check')
   .description('Report the current canonical hash for refs without materializing (freshness)')
   .option('--ref <ref>', 'skill ref (repeatable)', (v, acc) => { acc.push(v); return acc; }, [])
+  .option('--org <org>', 'resolve against this Drafted org (id or name); scopes per-request without switching the session')
   .option('--format <fmt>', 'output format: json or text', 'text')
   .action(async (opts) => {
     requireLogin();
     const results = [];
     for (const ref of (opts.ref || [])) {
-      try { results.push(await checkOneSkill(ref)); }
+      try { results.push(await checkOneSkill(ref, opts.org)); }
       catch (e) { results.push({ ref, slug: '', hash: '', status: 'error', error: String((e && e.message) || e) }); }
     }
     if (opts.format === 'json') console.log(JSON.stringify(results));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.8.5",
+  "version": "1.8.6",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [