@ainote/mcp 1.1.1 → 1.2.0

package/lib/tools/internal/encryption.js

@@ -0,0 +1,88 @@
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { getAgeIdentity, getAgeRecipients } from './keychain.js';
+
+const TMPDIR = os.tmpdir();
+
+function ageBinary() {
+  const r = spawnSync('age', ['--version'], { encoding: 'utf8' });
+  if (r.status !== 0) {
+    throw new Error('age binary not found. Install: brew install age');
+  }
+  return 'age';
+}
+
+function withTmpFile(prefix, body, fn) {
+  const tmp = path.join(TMPDIR, `${prefix}.${process.pid}.${Date.now()}`);
+  fs.writeFileSync(tmp, body, { mode: 0o600 });
+  try {
+    return fn(tmp);
+  } finally {
+    try { fs.unlinkSync(tmp); } catch {}
+  }
+}
+
+/**
+ * Encrypt plaintext for one or more recipients (age public keys).
+ * Returns base64 ciphertext.
+ */
+export async function encryptText(plaintext, { recipients } = {}) {
+  const recps = recipients || await getAgeRecipients();
+  if (!recps || recps.length === 0) {
+    throw new Error('No age recipients available. Run sync_init_encryption first.');
+  }
+  ageBinary();
+  return withTmpFile('ainote-enc-in', plaintext, (inputPath) => {
+    const args = ['-a']; // armored output
+    for (const r of recps) {
+      args.push('-r', r);
+    }
+    args.push(inputPath);
+    const r = spawnSync('age', args, { encoding: 'utf8' });
+    if (r.status !== 0) {
+      throw new Error(`age encrypt failed: ${r.stderr || 'unknown'}`);
+    }
+    return r.stdout;
+  });
+}
+
+/**
+ * Decrypt armored age ciphertext with this machine's identity from Keychain.
+ */
+export async function decryptText(ciphertext) {
+  ageBinary();
+  const identity = await getAgeIdentity();
+  if (!identity) {
+    throw new Error('No age identity for this machine. Run sync_init_encryption first.');
+  }
+  return withTmpFile('ainote-id', identity, (idPath) =>
+    withTmpFile('ainote-ct', ciphertext, (ctPath) => {
+      const r = spawnSync('age', ['-d', '-i', idPath, ctPath], { encoding: 'utf8' });
+      if (r.status !== 0) {
+        throw new Error(`age decrypt failed: ${r.stderr || 'unknown'}`);
+      }
+      return r.stdout;
+    })
+  );
+}
+
+/**
+ * Generate a new age keypair. Returns { identity, recipient }.
+ * Identity is the private key (AGE-SECRET-KEY-1...), recipient is the public (age1...).
+ */
+export function generateKeypair() {
+  ageBinary();
+  const r = spawnSync('age-keygen', [], { encoding: 'utf8' });
+  if (r.status !== 0) {
+    throw new Error(`age-keygen failed: ${r.stderr || 'unknown'}`);
+  }
+  const out = r.stdout;
+  const recpMatch = out.match(/# public key: (age1[a-z0-9]+)/i);
+  const idMatch = out.match(/(AGE-SECRET-KEY-1[A-Z0-9]+)/);
+  if (!recpMatch || !idMatch) {
+    throw new Error('Could not parse age-keygen output');
+  }
+  return { identity: out, recipient: recpMatch[1], identity_line: idMatch[1] };
+}

package/lib/tools/internal/keychain.js

@@ -0,0 +1,98 @@
+/**
+ * Cross-platform secret storage for ainote sync (async).
+ * - Primary: cross-keychain (macOS Keychain / libsecret / Windows Credential Manager)
+ * - Fallback: ~/.config/ainote/age-identity.txt (0600)
+ */
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+
+const SERVICE = 'ainote-sync';
+const ACCOUNT_IDENTITY = 'age-identity';
+const ACCOUNT_RECIPIENTS = 'age-recipients';
+
+const FALLBACK_DIR = path.join(os.homedir(), '.config', 'ainote');
+const FALLBACK_IDENTITY = path.join(FALLBACK_DIR, 'age-identity.txt');
+const FALLBACK_RECIPIENTS = path.join(FALLBACK_DIR, 'age-recipients.json');
+
+let ck = null;
+function getKeychain() {
+  if (ck !== null) return ck;
+  try {
+    ck = require('cross-keychain');
+  } catch {
+    ck = false;
+  }
+  return ck;
+}
+
+function fsRead(p) {
+  try { return fs.readFileSync(p, 'utf8'); } catch { return null; }
+}
+
+function fsWrite(p, value) {
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, value, { mode: 0o600 });
+}
+
+async function readSecret(account, fallbackPath) {
+  const kc = getKeychain();
+  if (kc && typeof kc.getPassword === 'function') {
+    try {
+      const v = await kc.getPassword(SERVICE, account);
+      if (v) return v;
+    } catch {}
+  }
+  return fsRead(fallbackPath);
+}
+
+async function writeSecret(account, value, fallbackPath) {
+  const kc = getKeychain();
+  if (kc && typeof kc.setPassword === 'function') {
+    try {
+      await kc.setPassword(SERVICE, account, value);
+      return 'keychain';
+    } catch {}
+  }
+  fsWrite(fallbackPath, value);
+  return `file:${fallbackPath}`;
+}
+
+export async function getAgeIdentity() {
+  return readSecret(ACCOUNT_IDENTITY, FALLBACK_IDENTITY);
+}
+
+export async function setAgeIdentity(identityText) {
+  return writeSecret(ACCOUNT_IDENTITY, identityText, FALLBACK_IDENTITY);
+}
+
+export async function getAgeRecipients() {
+  const raw = await readSecret(ACCOUNT_RECIPIENTS, FALLBACK_RECIPIENTS);
+  if (!raw) return [];
+  try {
+    const v = JSON.parse(raw);
+    return Array.isArray(v) ? v : [];
+  } catch {
+    return [];
+  }
+}
+
+export async function setAgeRecipients(list) {
+  return writeSecret(ACCOUNT_RECIPIENTS, JSON.stringify(list), FALLBACK_RECIPIENTS);
+}
+
+export async function addRecipient(recipient) {
+  const current = await getAgeRecipients();
+  if (!current.includes(recipient)) {
+    current.push(recipient);
+    await setAgeRecipients(current);
+  }
+  return current;
+}
+
+export function storageBackend() {
+  return getKeychain() ? 'cross-keychain' : 'file-fallback';
+}

package/lib/tools/internal/path-mapper.js

@@ -0,0 +1,221 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { execSync } from 'child_process';
+
+/**
+ * Cross-platform path mapper for ainote multi-device sync.
+ *
+ * Problem:
+ *   local_path is stored from the ORIGINAL machine (e.g. macOS).
+ *   When pulled on a DIFFERENT platform (e.g. WSL), paths don't match.
+ *
+ * Platform path patterns:
+ *   macOS:          HOME=/Users/<user>        project key: -Users-<user>
+ *   WSL:            HOME=/home/<user>          project key: -mnt-c-Users-<winuser>  (CWD=/mnt/c/Users/<winuser>)
+ *   Linux:          HOME=/home/<user>          project key: -home-<user>
+ *   Windows Native: HOME=C:\Users\<user>      project key: -C-Users-<user> or -Users-<user>
+ *
+ * Claude Code encodes CWD into project key by replacing / with -.
+ * The "global" memory lives under the home/CWD project key.
+ */
+
+// ── Platform detection ──
+
+function detectPlatform() {
+  if (process.platform === 'darwin') return 'macos';
+  if (process.platform === 'win32') return 'windows';
+
+  // Linux — check for WSL
+  try {
+    const ver = fs.readFileSync('/proc/version', 'utf8').toLowerCase();
+    if (ver.includes('microsoft') || ver.includes('wsl')) return 'wsl';
+  } catch { /* ignore */ }
+
+  return 'linux';
+}
+
+const CURRENT_PLATFORM = detectPlatform();
+const HOME = os.homedir();
+
+// ── Windows home detection for WSL ──
+
+function detectWindowsHome() {
+  if (CURRENT_PLATFORM !== 'wsl') return null;
+
+  // Method 1: WSLHOME env var (user-set)
+  if (process.env.WSLHOME) return process.env.WSLHOME;
+
+  // Method 2: cmd.exe to get USERPROFILE
+  try {
+    const profile = execSync('cmd.exe /C "echo %USERPROFILE%"', { encoding: 'utf8', timeout: 3000 })
+      .trim().replace(/\r?\n/g, '');
+    if (profile && !profile.includes('%')) {
+      // Convert C:\Users\Owner → /mnt/c/Users/Owner
+      return profile.replace(/^([A-Z]):\\/, (_, d) => `/mnt/${d.toLowerCase()}/`).replace(/\\/g, '/');
+    }
+  } catch { /* cmd.exe might not be available */ }
+
+  // Method 3: scan /mnt/c/Users/
+  try {
+    const usersDir = '/mnt/c/Users';
+    const skip = new Set(['Public', 'Default', 'Default User', 'All Users', 'desktop.ini']);
+    const entries = fs.readdirSync(usersDir).filter(e => {
+      if (skip.has(e)) return false;
+      try { return fs.statSync(path.join(usersDir, e)).isDirectory(); } catch { return false; }
+    });
+    if (entries.length === 1) return path.join(usersDir, entries[0]);
+    // Multiple users — try matching linux username
+    const linuxUser = os.userInfo().username;
+    const match = entries.find(e => e.toLowerCase() === linuxUser.toLowerCase());
+    if (match) return path.join(usersDir, match);
+    // Return first non-admin looking one
+    if (entries.length > 0) return path.join(usersDir, entries[0]);
+  } catch { /* not WSL or no /mnt/c */ }
+
+  return null;
+}
+
+// Cache Windows home (lazy)
+let _winHome;
+let _winHomeResolved = false;
+
+function getWindowsHome() {
+  if (!_winHomeResolved) {
+    _winHome = detectWindowsHome();
+    _winHomeResolved = true;
+  }
+  return _winHome;
+}
+
+// ── Claude project key ──
+
+/**
+ * Get the current platform's "home" project key.
+ * This is what Claude Code uses for the global memory directory.
+ */
+function currentHomeProjectKey() {
+  if (CURRENT_PLATFORM === 'wsl') {
+    const winHome = getWindowsHome();
+    if (winHome) return winHome.replace(/\//g, '-');
+  }
+  // macOS: -Users-seunghan, Linux: -home-seunghan
+  return HOME.replace(/\//g, '-');
+}
+
+// ── Home-dir project key detection ──
+// These regex patterns match the "home directory" project keys from each platform.
+
+const HOME_KEY_PATTERNS = [
+  /^-Users-[^-]+$/,               // macOS: -Users-seunghan
+  /^-mnt-[a-z]-Users-[^-]+$/,     // WSL:   -mnt-c-Users-Owner
+  /^-home-[^-]+$/,                // Linux: -home-seunghan
+  /^-[A-Z]-Users-[^-]+$/,         // Windows Native: -C-Users-Owner
+];
+
+// Project key patterns (home key + project name suffix)
+const PROJECT_KEY_EXTRACTORS = [
+  { pattern: /^-Users-[^-]+-(.+)$/,           platform: 'macos' },    // -Users-seunghan-launchcrew
+  { pattern: /^-mnt-[a-z]-Users-[^-]+-(.+)$/, platform: 'wsl' },      // -mnt-c-Users-Owner-launchcrew
+  { pattern: /^-home-[^-]+-(.+)$/,            platform: 'linux' },    // -home-seunghan-launchcrew
+  { pattern: /^-[A-Z]-Users-[^-]+-(.+)$/,     platform: 'windows' },  // -C-Users-Owner-launchcrew
+];
+
+function isHomeProjectKey(key) {
+  return HOME_KEY_PATTERNS.some(p => p.test(key));
+}
+
+function extractProjectName(key) {
+  for (const { pattern } of PROJECT_KEY_EXTRACTORS) {
+    const m = key.match(pattern);
+    if (m) return m[1];
+  }
+  return null;
+}
+
+// ── Home directory prefix patterns ──
+
+const HOME_PREFIX_PATTERNS = [
+  /^\/Users\/[^/]+/,              // macOS
+  /^\/mnt\/[a-z]\/Users\/[^/]+/,  // WSL (Windows files)
+  /^\/home\/[^/]+/,               // Linux / WSL native
+  /^[A-Z]:\\Users\\[^\\]+/,       // Windows Native
+];
+
+// ── Main path mapping ──
+
+/**
+ * Transform a stored local_path to work on the current platform.
+ *
+ * Examples (stored on macOS, pulled on WSL):
+ *   ~/.claude/projects/-Users-seunghan/memory/MEMORY.md
+ *   → ~/.claude/projects/-mnt-c-Users-Owner/memory/MEMORY.md
+ *   → /home/seunghan/.claude/projects/-mnt-c-Users-Owner/memory/MEMORY.md
+ *
+ *   /Users/seunghan/launchcrew/CLAUDE.md
+ *   → /home/seunghan/launchcrew/CLAUDE.md
+ */
+export function mapPathForCurrentPlatform(storedPath) {
+  if (!storedPath) return storedPath;
+
+  let p = storedPath;
+
+  // Step 1: Expand ~ to current HOME
+  p = p.replace(/^~/, HOME);
+
+  // Step 2: Replace any foreign home directory prefix with current HOME
+  for (const pattern of HOME_PREFIX_PATTERNS) {
+    if (pattern.test(p)) {
+      p = p.replace(pattern, HOME);
+      break;
+    }
+  }
+
+  // Step 3: Map Claude project keys
+  // Pattern: .../.claude/projects/<KEY>/...
+  const claudeProjectRegex = /(\/\.claude\/projects\/)([-\w]+)(\/)/;
+  const match = p.match(claudeProjectRegex);
+  if (match) {
+    const storedKey = match[2];
+    const myHomeKey = currentHomeProjectKey();
+
+    if (isHomeProjectKey(storedKey)) {
+      // Home project key → replace with current platform's home key
+      p = p.replace(claudeProjectRegex, `$1${myHomeKey}$3`);
+    } else {
+      // Project-specific key → extract project name + append to current home key
+      const projectName = extractProjectName(storedKey);
+      if (projectName) {
+        const newKey = `${myHomeKey}-${projectName}`;
+        p = p.replace(claudeProjectRegex, `$1${newKey}$3`);
+      }
+    }
+  }
+
+  return p;
+}
+
+/**
+ * Normalize a local_path to canonical form before storing.
+ * Replaces absolute home path with ~ for portability.
+ */
+export function canonicalizePath(localPath) {
+  if (!localPath) return localPath;
+  return localPath.replace(new RegExp(`^${escapeRegex(HOME)}`), '~');
+}
+
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Get current platform info (for diagnostics / tool output).
+ */
+export function getPlatformInfo() {
+  return {
+    platform: CURRENT_PLATFORM,
+    home: HOME,
+    homeProjectKey: currentHomeProjectKey(),
+    windowsHome: CURRENT_PLATFORM === 'wsl' ? getWindowsHome() : undefined,
+  };
+}

package/lib/tools/shared-tools.js

@@ -114,34 +114,75 @@ Returns structured data with all task fields including location, dates, and cate
   };
 }
 
+// Shared field definitions — keep create and update in sync so MCP exposes
+// the same surface for both operations. Server-side strong params
+// (Api::McpTasksController#task_params) accepts this full set.
+const TASK_FIELD_SCHEMA = {
+  content: {
+    type: 'string',
+    description: 'Task content'
+  },
+  is_important: {
+    type: 'boolean',
+    description: 'Mark task as important'
+  },
+  due_date: {
+    type: 'string',
+    description: 'Due date in ISO format (e.g., 2026-04-21T15:00:00+09:00)'
+  },
+  due_time: {
+    type: 'string',
+    description: 'Time of day in HH:MM (24h). Optional when due_date already carries a time.'
+  },
+  start_date: {
+    type: 'string',
+    description: 'Start date for multi-day events (ISO format). For single-day tasks, use due_date.'
+  },
+  is_all_day: {
+    type: 'boolean',
+    description: 'Mark as all-day event — suppresses time-of-day rendering.'
+  },
+  category_id: {
+    type: 'string',
+    description: 'Category ID. Must be owned by or shared to this user.'
+  },
+  notes: {
+    type: 'string',
+    description: 'Free-form notes / details attached to the task.'
+  },
+  location: {
+    type: 'string',
+    description: 'Human-readable location (e.g., "Starbucks Gangnam"). For GPS use location_lat/lng.'
+  },
+  location_lat: {
+    type: 'number',
+    description: 'GPS latitude. Pair with location_lng.'
+  },
+  location_lng: {
+    type: 'number',
+    description: 'GPS longitude. Pair with location_lat.'
+  },
+  travel_time: {
+    type: 'number',
+    description: 'Minutes of travel time before due_date to allow for. Used by reminder scheduling.'
+  },
+  repeat_rule: {
+    type: 'string',
+    description: 'Recurrence rule. Accepted values depend on server (e.g., "daily", "weekly", "monthly", or RRULE). Creates a recurring series.'
+  },
+  notification_minutes_before: {
+    type: 'number',
+    description: 'Schedule a reminder N minutes before due_date. Pass null/omit to clear existing MCP reminder on update. Requires due_date.'
+  }
+};
+
 function createTaskDefinition() {
   return {
     name: 'create_task',
-    description: 'Create a new task in AI Note with optional notification',
+    description: 'Create a new task in AI Note with optional notification, location, recurrence, and details.',
     inputSchema: {
       type: 'object',
-      properties: {
-        content: {
-          type: 'string',
-          description: 'Task content'
-        },
-        is_important: {
-          type: 'boolean',
-          description: 'Mark task as important'
-        },
-        due_date: {
-          type: 'string',
-          description: 'Due date in ISO format'
-        },
-        category_id: {
-          type: 'string',
-          description: 'Category ID'
-        },
-        notification_minutes_before: {
-          type: 'number',
-          description: 'Set notification X minutes before due_date (e.g., 5 for 5 minutes before, 60 for 1 hour before). Requires due_date to be set.'
-        }
-      },
+      properties: { ...TASK_FIELD_SCHEMA },
       required: ['content']
     }
   };
@@ -150,7 +191,7 @@ function createTaskDefinition() {
 function updateTaskDefinition() {
   return {
     name: 'update_task',
-    description: 'Update an existing task',
+    description: 'Update an existing task — any subset of fields. Pass notification_minutes_before to reschedule the reminder (or null to clear it).',
     inputSchema: {
       type: 'object',
       properties: {
@@ -158,18 +199,11 @@ function updateTaskDefinition() {
           type: 'string',
           description: 'Task ID'
         },
-        content: {
-          type: 'string',
-          description: 'New task content'
-        },
-        is_important: {
-          type: 'boolean',
-          description: 'Update important status'
-        },
         completed_at: {
           type: 'string',
           description: 'Mark as completed (ISO format) or null to uncomplete'
-        }
+        },
+        ...TASK_FIELD_SCHEMA
       },
       required: ['id']
     }

package/lib/utils/api-client.js

@@ -1,6 +1,8 @@
 import axios from 'axios';
 import { getConfig } from '../core/config-manager.js';
 
+const LOGIN_HINT = 'Please run `ainote-mcp login` to re-authenticate.';
+
 function buildHeaders(authContext, config) {
   const headers = {
     'Content-Type': 'application/json'
@@ -22,7 +24,7 @@ function buildHeaders(authContext, config) {
   } else {
     const apiKey = authContext?.apiKey ?? config.api.key;
     if (!apiKey) {
-      throw new Error('AINOTE_API_KEY environment variable is required for MCP authentication');
+      throw new Error(`AINOTE_API_KEY environment variable is required for MCP authentication. ${LOGIN_HINT}`);
     }
     headers.Authorization = `McpKey ${apiKey}`;
   }
@@ -54,6 +56,37 @@ function createToolCallRequest(toolName, arguments_) {
   });
 }
 
+function isBearerAuth(authContext) {
+  return authContext?.type === 'oauth';
+}
+
+async function tryRefreshAndUpdateHeaders(axiosInstance, config) {
+  // Only Bearer (access_token) flows can refresh. mcp_key flows cannot.
+  try {
+    const { refreshAccessToken } = await import('../auth/refresh.js');
+    const { getCredentials, setCredentials, clearCredentials } = await import('../auth/token-store.js');
+    const creds = await getCredentials(config.api.url);
+    if (!creds || !creds.refreshToken) {
+      return { refreshed: false, reason: 'no_refresh_token' };
+    }
+    const fresh = await refreshAccessToken({ apiUrl: config.api.url, refreshToken: creds.refreshToken });
+    const expiresAt = fresh.expires_in ? Date.now() + fresh.expires_in * 1000 : undefined;
+    await setCredentials(config.api.url, {
+      accessToken: fresh.access_token,
+      refreshToken: fresh.refresh_token,
+      expiresAt
+    });
+    axiosInstance.defaults.headers.common.Authorization = `Bearer ${fresh.access_token}`;
+    return { refreshed: true };
+  } catch (err) {
+    try {
+      const { clearCredentials } = await import('../auth/token-store.js');
+      await clearCredentials(config.api.url);
+    } catch { /* ignore */ }
+    return { refreshed: false, reason: err.message };
+  }
+}
+
 export function createApiClient(authContext) {
   const config = getConfig();
   const headers = buildHeaders(authContext, config);
@@ -63,6 +96,46 @@ export function createApiClient(authContext) {
     headers
   });
 
+  // Intercept 401s on bearer-authed requests and try one refresh + retry.
+  axiosInstance.interceptors.response.use(
+    (response) => response,
+    async (error) => {
+      const status = error.response?.status;
+      const originalRequest = error.config || {};
+      if (status !== 401 || originalRequest._retriedRefresh) {
+        return Promise.reject(error);
+      }
+
+      // Determine which auth scheme was in play for the original request.
+      const sentAuth = originalRequest.headers?.Authorization || originalRequest.headers?.authorization || '';
+      const isBearer = isBearerAuth(authContext) || /^Bearer\s/i.test(sentAuth);
+      const isMcpKey = /^McpKey\s/i.test(sentAuth);
+
+      if (isBearer) {
+        const result = await tryRefreshAndUpdateHeaders(axiosInstance, config);
+        if (result.refreshed) {
+          originalRequest._retriedRefresh = true;
+          originalRequest.headers = {
+            ...(originalRequest.headers || {}),
+            Authorization: axiosInstance.defaults.headers.common.Authorization
+          };
+          return axiosInstance.request(originalRequest);
+        }
+        const wrapped = new Error(`Authentication failed and refresh was not possible. ${LOGIN_HINT}`);
+        wrapped.cause = error;
+        return Promise.reject(wrapped);
+      }
+
+      if (isMcpKey) {
+        const wrapped = new Error(`MCP key was rejected by the server. ${LOGIN_HINT}`);
+        wrapped.cause = error;
+        return Promise.reject(wrapped);
+      }
+
+      return Promise.reject(error);
+    }
+  );
+
   // JSON-RPC helper 메서드 추가
   axiosInstance.callTool = async (toolName, arguments_) => {
     const rpcRequest = createToolCallRequest(toolName, arguments_);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainote/mcp",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "MCP server for AI Note - Tasks, Dev Docs, and multi-device file sync (CLAUDE.md, memory files, Cursor rules, Windsurf rules)",
   "main": "index.js",
   "type": "module",
@@ -55,8 +55,10 @@
     "@modelcontextprotocol/sdk": "^1.0.0",
     "axios": "^1.6.0",
     "cors": "^2.8.5",
+    "cross-keychain": "^1.1.0",
     "express": "^5.1.0",
-    "morgan": "^1.10.0"
+    "morgan": "^1.10.0",
+    "open": "^10.2.0"
   },
   "devDependencies": {
     "@jest/globals": "^29.7.0",
@@ -95,4 +97,4 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   }
-}
+}