@ainote/mcp 1.3.3 → 1.3.4

package/README.md

@@ -193,7 +193,7 @@ The fallback file is only used when no system keychain is available (e.g. headle
 
 ### Environment overrides
 
-- `AINOTE_API_URL` — backend URL (default `https://api.ainote.dev`)
+- `AINOTE_API_URL` — backend URL (default `https://ainote-5muq.onrender.com`; `login`, `call`, and the MCP server all share it, since stored credentials are keyed by host)
 - `AINOTE_API_KEY` — pre-provisioned MCP key. When set, the login flow is bypassed entirely and this key is used as-is.
 
 ### Headless / CI usage
@@ -437,7 +437,7 @@ By default the server listens on `http://localhost:3030` and exposes two endpoin
 Environment variable | Description | Default
 ---|---|---
 `AINOTE_API_KEY` | API key used for MCP key authentication | **required**
-`AINOTE_API_URL` | Target AI Note API base URL | `https://api.ainote.dev`
+`AINOTE_API_URL` | Target AI Note API base URL | `https://ainote-5muq.onrender.com`
 `AINOTE_MCP_HTTP_PORT` | Local port for the SSE server | `3030`
 `AINOTE_MCP_ALLOWED_ORIGINS` | Comma-separated list of allowed browser origins | _any_
 `AINOTE_MCP_ALLOWED_HOSTS` | Comma-separated list of allowed `Host` headers | _any_

package/lib/auth/mcp-key.js

@@ -29,7 +29,8 @@ export async function authenticateWithMcpKeyAsync() {
 
   try {
     const { getCredentials } = await import('./token-store.js');
-    const baseUrl = process.env.AINOTE_API_URL || 'https://ainote-5muq.onrender.com';
+    const { resolveApiUrl } = await import('../core/config-manager.js');
+    const baseUrl = resolveApiUrl();
     const creds = await getCredentials(baseUrl);
     if (creds && creds.mcpKey) {
       return { type: 'mcpKey', apiKey: creds.mcpKey };

package/lib/auth/token-store.js

@@ -82,8 +82,25 @@ function apiHost(apiUrl) {
   }
 }
 
+/**
+ * Keychain account name for a (host, field) pair.
+ *
+ * Same cross-keychain constraint as keychainService(): account names must match
+ * /^[a-zA-Z0-9._@-]+$/ on every backend. The previous `${host}:${field}` form
+ * was rejected outright (the ':' separator, plus any ':port' in the host), so
+ * every keychain read/write threw and credentials always fell back to the file.
+ *
+ * Format: `${sanitizedHost}@${field}`. The host is reduced to [a-zA-Z0-9.-]
+ * (any other char, e.g. a port ':' or IPv6 brackets, becomes '_'), so it can
+ * never contain '@'; the '@' separator therefore keeps host and field
+ * unambiguously distinct. Deterministic for a given apiUrl.
+ *
+ * No migration: since the old ':'-based names were always rejected, nothing
+ * was ever stored under them in any keychain.
+ */
 function accountFor(apiUrl, field) {
-  return `${apiHost(apiUrl)}:${field}`;
+  const host = String(apiHost(apiUrl)).replace(/[^a-zA-Z0-9.-]/g, '_');
+  return `${host}@${field}`;
 }
 
 function readFileStore() {
@@ -300,3 +317,10 @@ export function _credentialsLocations() {
     file: getCredentialsFile()
   };
 }
+
+/**
+ * Internal helper exposing keychain account names for tests. Not public API.
+ */
+export function _keychainAccount(apiUrl, field) {
+  return accountFor(apiUrl, field);
+}

package/lib/cli/call.js

@@ -10,7 +10,9 @@
  *   1. AINOTE_API_KEY env
  *   2. token store (mcpKey written by `ainote-mcp login`)
  *
- * Posts JSON-RPC 2.0 `tools/call` to AINOTE_API_URL (default https://api.ainote.dev/api/mcp).
+ * Posts JSON-RPC 2.0 `tools/call` to AINOTE_API_URL
+ * (default DEFAULT_API_URL from lib/core/config-manager.js, i.e. the same host
+ * `ainote-mcp login` stores credentials under), path /api/mcp.
  *
  * Argument parsing supports two styles, in priority order:
  *   --json '{"due_today": true}'    raw JSON object as arguments
@@ -26,8 +28,7 @@
 import process from 'node:process';
 import axios from 'axios';
 import { getCredentials } from '../auth/token-store.js';
-
-const DEFAULT_API_URL = 'https://api.ainote.dev';
+import { DEFAULT_API_URL, resolveApiUrl } from '../core/config-manager.js';
 
 function parseArgs(argv) {
   // argv shape: [toolName, ...flags]
@@ -85,7 +86,8 @@ Usage: ainote-mcp call <tool> [options]
 
 Direct shell invocation of an ainote MCP tool over HTTP. Bypasses any
 running MCP host (Claude Desktop, Cursor, etc.) and posts directly to
-api.ainote.dev — useful for scripts and one-off queries.
+the AI Note API (AINOTE_API_URL, default ${DEFAULT_API_URL}) — useful
+for scripts and one-off queries.
 
 Authentication:
   - AINOTE_API_KEY env var, OR
@@ -135,7 +137,7 @@ export async function run(argv) {
     return;
   }
 
-  const apiUrl = (process.env.AINOTE_API_URL || DEFAULT_API_URL).replace(/\/+$/, '');
+  const apiUrl = resolveApiUrl();
 
   let mcpKey = process.env.AINOTE_API_KEY;
   if (!mcpKey) {

package/lib/cli/login.js

@@ -27,8 +27,8 @@ import {
   DeviceNetworkError
 } from '../auth/device-flow.js';
 import { setCredentials, _credentialsLocations } from '../auth/token-store.js';
+import { resolveApiUrl } from '../core/config-manager.js';
 
-const DEFAULT_API_URL = 'https://ainote-5muq.onrender.com';
 const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
 
 function parseArgs(argv) {
@@ -117,7 +117,7 @@ async function tryOpenBrowser(uri) {
 }
 
 export async function run(argv = process.argv.slice(3)) {
-  const apiUrl = (process.env.AINOTE_API_URL || DEFAULT_API_URL).replace(/\/+$/, '');
+  const apiUrl = resolveApiUrl();
   const args = parseArgs(argv);
   const scopes = args.scope.split(',').map((s) => s.trim()).filter(Boolean);
 

package/lib/cli/logout.js

@@ -4,11 +4,10 @@
 import process from 'node:process';
 import axios from 'axios';
 import { getCredentials, clearCredentials } from '../auth/token-store.js';
-
-const DEFAULT_API_URL = 'https://ainote-5muq.onrender.com';
+import { resolveApiUrl } from '../core/config-manager.js';
 
 export async function run() {
-  const apiUrl = (process.env.AINOTE_API_URL || DEFAULT_API_URL).replace(/\/+$/, '');
+  const apiUrl = resolveApiUrl();
 
   const creds = await getCredentials(apiUrl);
 

package/lib/cli/whoami.js

@@ -12,8 +12,7 @@
 import process from 'node:process';
 import axios from 'axios';
 import { getCredentials } from '../auth/token-store.js';
-
-const DEFAULT_API_URL = 'https://ainote-5muq.onrender.com';
+import { resolveApiUrl } from '../core/config-manager.js';
 
 function summarizeUser(user) {
   if (!user || typeof user !== 'object') return null;
@@ -25,7 +24,7 @@ function summarizeUser(user) {
 }
 
 export async function run() {
-  const apiUrl = (process.env.AINOTE_API_URL || DEFAULT_API_URL).replace(/\/+$/, '');
+  const apiUrl = resolveApiUrl();
   const creds = await getCredentials(apiUrl);
 
   if (!creds) {

package/lib/core/config-manager.js

@@ -1,4 +1,24 @@
-const DEFAULT_API_URL = 'https://ainote-5muq.onrender.com';
+/**
+ * Single source of truth for the default AI Note backend URL.
+ *
+ * Every entry point (MCP server, `login`, `logout`, `whoami`, `call`) must
+ * resolve the API URL through resolveApiUrl(). Credentials written by
+ * `ainote-mcp login` are namespaced by API host in the token store, so any
+ * divergence here makes the other commands look up the wrong host.
+ *
+ * (api.ainote.dev is currently a CNAME to this same Render service, but it is
+ * a different token-store key, so the default must stay identical everywhere.)
+ */
+export const DEFAULT_API_URL = 'https://ainote-5muq.onrender.com';
+
+/**
+ * Resolve the effective API base URL: AINOTE_API_URL env override, else the
+ * default. Trailing slashes are stripped so "${url}/api/..." joins cleanly.
+ */
+export function resolveApiUrl(env = process.env) {
+  return (env.AINOTE_API_URL || DEFAULT_API_URL).replace(/\/+$/, '');
+}
+
 const DEFAULT_HTTP_PORT = 3030;
 
 const parseBoolean = (value, fallback) => {
@@ -57,7 +77,7 @@ export function getConfig() {
   return {
     api: {
       key: process.env.AINOTE_API_KEY,
-      url: process.env.AINOTE_API_URL || DEFAULT_API_URL
+      url: resolveApiUrl()
     },
     http: {
       port: parseNumber(process.env.AINOTE_MCP_HTTP_PORT, DEFAULT_HTTP_PORT),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainote/mcp",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "mcpName": "io.github.seunghan91/ainote",
   "description": "MCP server for AI Note - Tasks, Dev Docs, and multi-device file sync (CLAUDE.md, memory files, Cursor rules, Windsurf rules)",
   "main": "index.js",