@ainote/mcp 1.1.1 → 1.3.0

package/lib/auth/token-store.js

@@ -0,0 +1,286 @@
+/**
+ * Credential persistence for the CLI.
+ *
+ * Primary: OS keychain via `cross-keychain` (macOS Keychain, libsecret,
+ *          Windows Credential Manager). Loaded lazily via createRequire so
+ *          import never fails on platforms without it.
+ * Fallback: ${XDG_CONFIG_HOME:-~/.config}/ainote/credentials.json with
+ *           directory mode 0o700 and file mode 0o600.
+ *
+ * Schema (file):
+ *   {
+ *     "<apiUrlHost>": {
+ *       "mcp_key": "...",
+ *       "access_token": "at_...",
+ *       "refresh_token": "rt_...",
+ *       "expires_at": 1700000000000  // ms since epoch
+ *     },
+ *     ...
+ *   }
+ *
+ * Each environment (host) is namespaced so multiple ainote deployments
+ * (prod / staging / localhost) can coexist on one machine.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import url from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const SERVICE = '@ainote/cli';
+const FIELDS = ['mcp_key', 'access_token', 'refresh_token', 'expires_at'];
+
+let keychainModule = null;
+let keychainProbed = false;
+
+function getKeychain() {
+  if (keychainProbed) return keychainModule;
+  keychainProbed = true;
+  try {
+    keychainModule = require('cross-keychain');
+  } catch (err) {
+    process.stderr.write(`[ainote-mcp] cross-keychain unavailable, using file fallback: ${err.message}\n`);
+    keychainModule = null;
+  }
+  return keychainModule;
+}
+
+function getCredentialsDir() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const base = xdg && xdg.length > 0 ? xdg : path.join(os.homedir(), '.config');
+  return path.join(base, 'ainote');
+}
+
+function getCredentialsFile() {
+  return path.join(getCredentialsDir(), 'credentials.json');
+}
+
+function apiHost(apiUrl) {
+  try {
+    const parsed = new url.URL(apiUrl);
+    return parsed.host || apiUrl;
+  } catch {
+    return apiUrl;
+  }
+}
+
+function accountFor(apiUrl, field) {
+  return `${apiHost(apiUrl)}:${field}`;
+}
+
+function readFileStore() {
+  const file = getCredentialsFile();
+  try {
+    const raw = fs.readFileSync(file, 'utf8');
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch (err) {
+    if (err.code !== 'ENOENT') {
+      process.stderr.write(`[ainote-mcp] credentials.json read failed: ${err.message}\n`);
+    }
+    return {};
+  }
+}
+
+function writeFileStore(store) {
+  const dir = getCredentialsDir();
+  try {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  } catch (err) {
+    if (err.code !== 'EEXIST') throw err;
+  }
+  // Try to tighten directory perms even if mkdir didn't get to chmod (older Node).
+  try { fs.chmodSync(dir, 0o700); } catch { /* best effort */ }
+
+  const file = getCredentialsFile();
+  const tmp = `${file}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(store, null, 2), { mode: 0o600 });
+  try { fs.chmodSync(tmp, 0o600); } catch { /* best effort */ }
+  fs.renameSync(tmp, file);
+  try { fs.chmodSync(file, 0o600); } catch { /* best effort */ }
+}
+
+async function keychainGet(apiUrl, field) {
+  const kc = getKeychain();
+  if (!kc || typeof kc.getPassword !== 'function') return null;
+  try {
+    const value = await kc.getPassword(SERVICE, accountFor(apiUrl, field));
+    return value || null;
+  } catch (err) {
+    process.stderr.write(`[ainote-mcp] keychain read failed (${field}): ${err.message}\n`);
+    return null;
+  }
+}
+
+async function keychainSet(apiUrl, field, value) {
+  const kc = getKeychain();
+  if (!kc || typeof kc.setPassword !== 'function') return false;
+  try {
+    if (value === null || value === undefined || value === '') {
+      if (typeof kc.deletePassword === 'function') {
+        await kc.deletePassword(SERVICE, accountFor(apiUrl, field));
+      }
+      return true;
+    }
+    await kc.setPassword(SERVICE, accountFor(apiUrl, field), String(value));
+    return true;
+  } catch (err) {
+    process.stderr.write(`[ainote-mcp] keychain write failed (${field}): ${err.message}\n`);
+    return false;
+  }
+}
+
+async function keychainDelete(apiUrl, field) {
+  const kc = getKeychain();
+  if (!kc || typeof kc.deletePassword !== 'function') return false;
+  try {
+    await kc.deletePassword(SERVICE, accountFor(apiUrl, field));
+    return true;
+  } catch (err) {
+    if (err && /not found/i.test(err.message)) return true;
+    return false;
+  }
+}
+
+/**
+ * Read credentials for the given API URL. Returns `null` if nothing is stored.
+ *
+ * Tries keychain first for each field; falls back to file. If both yield
+ * nothing, returns null. Mixed sources (keychain mcp_key + file refresh) are
+ * permitted and merged.
+ *
+ * @returns {Promise<null | {mcpKey?: string, accessToken?: string,
+ *   refreshToken?: string, expiresAt?: number, source: 'keychain'|'file'|'mixed'}>}
+ */
+export async function getCredentials(apiUrl) {
+  const host = apiHost(apiUrl);
+
+  const fileStore = readFileStore();
+  const fileEntry = fileStore[host] || {};
+
+  const kc = getKeychain();
+  const result = {};
+  let usedKeychain = false;
+  let usedFile = false;
+
+  for (const field of FIELDS) {
+    let value = null;
+    if (kc) {
+      value = await keychainGet(apiUrl, field);
+      if (value !== null && value !== undefined) usedKeychain = true;
+    }
+    if (value === null || value === undefined) {
+      if (fileEntry[field] !== undefined && fileEntry[field] !== null) {
+        value = fileEntry[field];
+        usedFile = true;
+      }
+    }
+    if (value !== null && value !== undefined && value !== '') {
+      result[field] = value;
+    }
+  }
+
+  if (Object.keys(result).length === 0) return null;
+
+  const out = {
+    mcpKey: result.mcp_key,
+    accessToken: result.access_token,
+    refreshToken: result.refresh_token,
+    expiresAt: result.expires_at ? Number(result.expires_at) : undefined,
+    source: usedKeychain && usedFile ? 'mixed' : usedKeychain ? 'keychain' : 'file'
+  };
+  return out;
+}
+
+/**
+ * Persist credentials. Writes to keychain when available; ALWAYS also writes
+ * a minimal file shadow when keychain write fails for any field, so the user
+ * can still authenticate after a partial-failure scenario.
+ *
+ * @param {string} apiUrl
+ * @param {{mcpKey?: string, accessToken?: string, refreshToken?: string, expiresAt?: number|string}} creds
+ * @returns {Promise<{storage: 'keychain'|'file'|'mixed', file?: string}>}
+ */
+export async function setCredentials(apiUrl, creds) {
+  const host = apiHost(apiUrl);
+  const mapping = {
+    mcp_key: creds.mcpKey,
+    access_token: creds.accessToken,
+    refresh_token: creds.refreshToken,
+    expires_at: creds.expiresAt === undefined ? undefined : String(creds.expiresAt)
+  };
+
+  let keychainOk = true;
+  let anyKeychain = false;
+
+  for (const [field, value] of Object.entries(mapping)) {
+    if (value === undefined) continue;
+    const ok = await keychainSet(apiUrl, field, value);
+    if (ok) anyKeychain = true;
+    else keychainOk = false;
+  }
+
+  let fileWritten = false;
+  if (!anyKeychain || !keychainOk) {
+    // Write or merge file store so credentials survive even if some keychain
+    // writes failed.
+    const store = readFileStore();
+    const entry = { ...(store[host] || {}) };
+    for (const [field, value] of Object.entries(mapping)) {
+      if (value === undefined) continue;
+      if (value === null || value === '') delete entry[field];
+      else entry[field] = field === 'expires_at' ? Number(value) : value;
+    }
+    store[host] = entry;
+    writeFileStore(store);
+    fileWritten = true;
+  }
+
+  let storage;
+  if (anyKeychain && !fileWritten) storage = 'keychain';
+  else if (!anyKeychain && fileWritten) storage = 'file';
+  else storage = 'mixed';
+
+  return {
+    storage,
+    file: fileWritten ? getCredentialsFile() : undefined
+  };
+}
+
+/**
+ * Remove credentials for the given API URL from both keychain and file.
+ * Best-effort: errors are swallowed and the caller can assume cleared state.
+ */
+export async function clearCredentials(apiUrl) {
+  const host = apiHost(apiUrl);
+
+  for (const field of FIELDS) {
+    await keychainDelete(apiUrl, field);
+  }
+
+  try {
+    const store = readFileStore();
+    if (store[host]) {
+      delete store[host];
+      if (Object.keys(store).length === 0) {
+        try { fs.unlinkSync(getCredentialsFile()); } catch { /* ignore */ }
+      } else {
+        writeFileStore(store);
+      }
+    }
+  } catch (err) {
+    process.stderr.write(`[ainote-mcp] file credentials clear failed: ${err.message}\n`);
+  }
+}
+
+/**
+ * Internal helper for diagnostics. Not part of public API.
+ */
+export function _credentialsLocations() {
+  return {
+    keychainService: SERVICE,
+    file: getCredentialsFile()
+  };
+}

package/lib/cli/login.js

@@ -0,0 +1,238 @@
+/**
+ * `ainote-mcp login` — interactive device-authorization grant flow.
+ *
+ * UX:
+ *   1. Request device code from server.
+ *   2. Display the user_code in an ASCII box.
+ *   3. Print verification URL and try to open it in a browser (unless --no-browser).
+ *   4. Spin while polling for token.
+ *   5. On success, persist to keychain/file.
+ *
+ * Flags:
+ *   --scope=mcp,read,write   Comma-separated scope list (default: mcp,read,write).
+ *   --no-browser             Don't auto-open the verification URL.
+ *   --client-name=<name>     Override client_name shown on the consent screen.
+ *
+ * SIGINT cancels the in-flight authorization (best effort) and exits 1.
+ */
+import process from 'node:process';
+import os from 'node:os';
+import {
+  requestDeviceCode,
+  pollForToken,
+  cancel,
+  DeviceAccessDeniedError,
+  DeviceExpiredError,
+  DevicePkceError,
+  DeviceNetworkError
+} from '../auth/device-flow.js';
+import { setCredentials, _credentialsLocations } from '../auth/token-store.js';
+
+const DEFAULT_API_URL = 'https://ainote-5muq.onrender.com';
+const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+
+function parseArgs(argv) {
+  const args = {
+    scope: 'mcp,read,write',
+    noBrowser: false,
+    clientName: `ainote-mcp CLI (${os.hostname()})`
+  };
+  for (const arg of argv) {
+    if (arg === '--no-browser') {
+      args.noBrowser = true;
+    } else if (arg.startsWith('--scope=')) {
+      args.scope = arg.slice('--scope='.length);
+    } else if (arg === '--scope') {
+      // next-token form is not supported in this minimal parser
+      args.scope = args.scope;
+    } else if (arg.startsWith('--client-name=')) {
+      args.clientName = arg.slice('--client-name='.length);
+    }
+  }
+  return args;
+}
+
+function drawUserCodeBox(userCode) {
+  const padded = `   ${userCode}   `;
+  const width = padded.length;
+  const top = `┌${'─'.repeat(width)}┐`;
+  const mid = `│${padded}│`;
+  const bot = `└${'─'.repeat(width)}┘`;
+  return `${top}\n${mid}\n${bot}`;
+}
+
+class Spinner {
+  constructor() {
+    this.frame = 0;
+    this.suffix = '';
+    this.timer = null;
+    this.active = false;
+  }
+
+  start(initialSuffix = '') {
+    if (this.active) return;
+    this.active = true;
+    this.suffix = initialSuffix;
+    this.timer = setInterval(() => this._render(), 100);
+    this._render();
+  }
+
+  update(suffix) {
+    this.suffix = suffix;
+  }
+
+  _render() {
+    const frame = SPINNER_FRAMES[this.frame % SPINNER_FRAMES.length];
+    this.frame += 1;
+    if (process.stderr.isTTY) {
+      process.stderr.write(`\r${frame} ${this.suffix}\x1b[K`);
+    }
+  }
+
+  stop(finalLine) {
+    if (!this.active) return;
+    this.active = false;
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+    if (process.stderr.isTTY) {
+      process.stderr.write('\r\x1b[K');
+    }
+    if (finalLine) {
+      process.stderr.write(`${finalLine}\n`);
+    }
+  }
+}
+
+async function tryOpenBrowser(uri) {
+  try {
+    const mod = await import('open');
+    const open = mod.default || mod;
+    await open(uri);
+    return true;
+  } catch (err) {
+    return false;
+  }
+}
+
+export async function run(argv = process.argv.slice(3)) {
+  const apiUrl = (process.env.AINOTE_API_URL || DEFAULT_API_URL).replace(/\/+$/, '');
+  const args = parseArgs(argv);
+  const scopes = args.scope.split(',').map((s) => s.trim()).filter(Boolean);
+
+  console.log('');
+  console.log(`  AI Note MCP — Login`);
+  console.log(`  API: ${apiUrl}`);
+  console.log('');
+
+  let device;
+  try {
+    device = await requestDeviceCode({
+      apiUrl,
+      clientName: args.clientName,
+      scopes
+    });
+  } catch (err) {
+    if (err instanceof DeviceNetworkError) {
+      console.error(`  Network error: ${err.message}`);
+    } else {
+      console.error(`  Failed to start login: ${err.message}`);
+    }
+    process.exit(1);
+    return;
+  }
+
+  console.log(`  Visit the URL below and enter the code:`);
+  console.log('');
+  console.log(drawUserCodeBox(device.user_code));
+  console.log('');
+  console.log(`  ${device.verification_uri}`);
+  if (device.verification_uri_complete && device.verification_uri_complete !== device.verification_uri) {
+    console.log(`  (direct link: ${device.verification_uri_complete})`);
+  }
+  console.log('');
+
+  if (!args.noBrowser) {
+    const target = device.verification_uri_complete || device.verification_uri;
+    const opened = await tryOpenBrowser(target);
+    if (opened) {
+      console.log('  Opening your browser…');
+    } else {
+      console.log('  (Could not open browser automatically — please open the URL above.)');
+    }
+    console.log('');
+  }
+
+  const spinner = new Spinner();
+  spinner.start(`Waiting for authorization… (0s elapsed, next poll in ${device.interval}s)`);
+
+  let cancelled = false;
+  const sigintHandler = async () => {
+    if (cancelled) return;
+    cancelled = true;
+    spinner.stop('Cancelled.');
+    await cancel({ apiUrl, deviceCode: device.device_code });
+    process.exit(1);
+  };
+  process.once('SIGINT', sigintHandler);
+
+  try {
+    const tokens = await pollForToken({
+      apiUrl,
+      deviceCode: device.device_code,
+      codeVerifier: device.code_verifier,
+      interval: device.interval,
+      expiresIn: device.expires_in,
+      onTick: ({ elapsed, interval }) => {
+        spinner.update(`Waiting for authorization… (${elapsed}s elapsed, next poll in ${interval}s)`);
+      }
+    });
+
+    spinner.stop();
+    process.removeListener('SIGINT', sigintHandler);
+
+    const expiresAt = tokens.expires_in
+      ? Date.now() + Number(tokens.expires_in) * 1000
+      : undefined;
+
+    const persisted = await setCredentials(apiUrl, {
+      mcpKey: tokens.mcp_key,
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token,
+      expiresAt
+    });
+
+    const email = tokens.user?.email;
+    const locationDesc = persisted.storage === 'keychain'
+      ? 'OS keychain'
+      : persisted.storage === 'mixed'
+        ? `OS keychain + ${persisted.file}`
+        : persisted.file || _credentialsLocations().file;
+
+    console.log('');
+    if (email) {
+      console.log(`  ✓ Logged in as ${email}.`);
+    } else {
+      console.log(`  ✓ Logged in.`);
+    }
+    console.log(`  Credentials saved to ${locationDesc}.`);
+    console.log('');
+  } catch (err) {
+    spinner.stop();
+    process.removeListener('SIGINT', sigintHandler);
+
+    if (err instanceof DeviceAccessDeniedError) {
+      console.error('  Access denied. The authorization request was rejected.');
+    } else if (err instanceof DeviceExpiredError) {
+      console.error('  Code expired. Please run `ainote-mcp login` again.');
+    } else if (err instanceof DevicePkceError) {
+      console.error('  Authentication failed (PKCE mismatch). Please retry.');
+    } else if (err instanceof DeviceNetworkError) {
+      console.error(`  Network error: ${err.message}`);
+    } else {
+      console.error(`  Login failed: ${err.message}`);
+    }
+    process.exit(1);
+  }
+}

package/lib/cli/logout.js

@@ -0,0 +1,39 @@
+/**
+ * `ainote-mcp logout` — revoke server-side tokens and clear local credentials.
+ */
+import process from 'node:process';
+import axios from 'axios';
+import { getCredentials, clearCredentials } from '../auth/token-store.js';
+
+const DEFAULT_API_URL = 'https://ainote-5muq.onrender.com';
+
+export async function run() {
+  const apiUrl = (process.env.AINOTE_API_URL || DEFAULT_API_URL).replace(/\/+$/, '');
+
+  const creds = await getCredentials(apiUrl);
+
+  if (!creds) {
+    console.log('  No credentials found. Already logged out.');
+    return;
+  }
+
+  if (creds.refreshToken) {
+    try {
+      await axios.post(
+        `${apiUrl}/api/auth/token/revoke`,
+        { refresh_token: creds.refreshToken },
+        {
+          headers: { 'Content-Type': 'application/json' },
+          timeout: 10000,
+          validateStatus: () => true
+        }
+      );
+    } catch (err) {
+      // Server-side revoke is best-effort. Continue with local clear.
+      process.stderr.write(`[ainote-mcp] Server revoke failed (continuing): ${err.message}\n`);
+    }
+  }
+
+  await clearCredentials(apiUrl);
+  console.log('  Logged out.');
+}

package/lib/cli/whoami.js

@@ -0,0 +1,77 @@
+/**
+ * `ainote-mcp whoami` — show the currently authenticated user.
+ *
+ * Strategy:
+ *   1. Read credentials from the token store.
+ *   2. If we have an access_token, hit GET /api/users/me with Bearer auth and
+ *      print the response.
+ *   3. If the API call fails (404, 401, network) but we have a stored mcp_key,
+ *      print a minimal local-only summary so the user at least sees that
+ *      credentials exist for this host.
+ */
+import process from 'node:process';
+import axios from 'axios';
+import { getCredentials } from '../auth/token-store.js';
+
+const DEFAULT_API_URL = 'https://ainote-5muq.onrender.com';
+
+function summarizeUser(user) {
+  if (!user || typeof user !== 'object') return null;
+  const parts = [];
+  if (user.email) parts.push(user.email);
+  else if (user.name) parts.push(user.name);
+  else if (user.id) parts.push(`user #${user.id}`);
+  return parts.join(' ');
+}
+
+export async function run() {
+  const apiUrl = (process.env.AINOTE_API_URL || DEFAULT_API_URL).replace(/\/+$/, '');
+  const creds = await getCredentials(apiUrl);
+
+  if (!creds) {
+    console.error('  Not logged in. Run `ainote-mcp login`.');
+    process.exit(1);
+    return;
+  }
+
+  let identity = null;
+
+  if (creds.accessToken) {
+    try {
+      const response = await axios.get(`${apiUrl}/api/users/me`, {
+        headers: {
+          Authorization: `Bearer ${creds.accessToken}`,
+          Accept: 'application/json'
+        },
+        timeout: 15000,
+        validateStatus: () => true
+      });
+      if (response.status >= 200 && response.status < 300) {
+        const body = response.data || {};
+        identity = summarizeUser(body.user || body.data || body) || summarizeUser(body);
+      }
+    } catch {
+      // fall through to local-only fallback below
+    }
+  }
+
+  if (identity) {
+    console.log(`  Logged in as ${identity}`);
+  } else {
+    // Local-only fallback: report what we have.
+    const host = (() => {
+      try { return new URL(apiUrl).host; } catch { return apiUrl; }
+    })();
+    console.log(`  Credentials present for ${host}`);
+    if (creds.mcpKey) console.log(`  MCP key: ${creds.mcpKey.slice(0, 8)}…`);
+    if (creds.expiresAt) {
+      const remaining = Math.floor((creds.expiresAt - Date.now()) / 1000);
+      if (remaining > 0) console.log(`  Access token expires in ~${remaining}s`);
+      else console.log(`  Access token expired (refresh on next call).`);
+    }
+    if (!creds.accessToken && !creds.mcpKey) {
+      console.error('  Could not verify identity. Try `ainote-mcp login` again.');
+      process.exit(1);
+    }
+  }
+}

package/lib/core/config-manager.js

@@ -39,6 +39,14 @@ const parseList = (value) => {
     .filter((item) => item.length > 0);
 };
 
+/**
+ * Synchronous config snapshot. Reads env vars only — used by the JSON-RPC
+ * stdio entry path that cannot await.
+ *
+ * Note: stored CLI credentials (mcp_key from `ainote-mcp login`) are loaded
+ * asynchronously by `getConfigAsync()` below. Callers that can await should
+ * prefer the async form.
+ */
 export function getConfig() {
   const features = {
     chatgptSupport: parseBoolean(process.env.AINOTE_ENABLE_CHATGPT_SUPPORT, true),
@@ -58,10 +66,41 @@ export function getConfig() {
       allowedOrigins: parseList(process.env.AINOTE_MCP_ALLOWED_ORIGINS),
       allowedHosts: parseList(process.env.AINOTE_MCP_ALLOWED_HOSTS)
     },
-    features
+    features,
+    requiresLogin: !process.env.AINOTE_API_KEY
   };
 }
 
+/**
+ * Async config that consults the local token store for an mcp_key when the
+ * environment variable is unset. Used by the stdio entry path that runs
+ * `await getConfigAsync()` at startup.
+ */
+export async function getConfigAsync() {
+  const base = getConfig();
+
+  if (base.api.key) {
+    return { ...base, requiresLogin: false };
+  }
+
+  try {
+    const { getCredentials } = await import('../auth/token-store.js');
+    const creds = await getCredentials(base.api.url);
+    if (creds && creds.mcpKey) {
+      return {
+        ...base,
+        api: { ...base.api, key: creds.mcpKey },
+        requiresLogin: false,
+        api_key_source: 'token-store'
+      };
+    }
+  } catch (err) {
+    process.stderr.write(`[ainote-mcp] token store unavailable: ${err.message}\n`);
+  }
+
+  return { ...base, requiresLogin: true };
+}
+
 export function getFeatureFlags() {
   return getConfig().features;
 }