@ainote/mcp 1.3.6 → 1.3.7

package/README-ko.md

@@ -156,7 +156,7 @@ npm install
 export AINOTE_API_KEY="여기에-api-키-입력"
 
 # 선택사항 (기본값: 프로덕션 URL)
-export AINOTE_API_URL="https://ainote-5muq.onrender.com"
+export AINOTE_API_URL="https://api.ainote.dev"
 ```
 
 ### 2. Claude Desktop 설정
@@ -177,7 +177,7 @@ Claude Desktop 설정 파일에 다음 내용을 추가하세요:
       ],
       "env": {
         "AINOTE_API_KEY": "YOUR_API_KEY",
-        "AINOTE_API_URL": "https://ainote-5muq.onrender.com"
+        "AINOTE_API_URL": "https://api.ainote.dev"
       }
     }
   }
@@ -193,7 +193,7 @@ Claude Desktop 설정 파일에 다음 내용을 추가하세요:
       "command": "ainote-mcp",
       "env": {
         "AINOTE_API_KEY": "YOUR_API_KEY",
-        "AINOTE_API_URL": "https://ainote-5muq.onrender.com"
+        "AINOTE_API_URL": "https://api.ainote.dev"
       }
     }
   }

package/README.md

@@ -193,7 +193,7 @@ The fallback file is only used when no system keychain is available (e.g. headle
 
 ### Environment overrides
 
-- `AINOTE_API_URL` — backend URL (default `https://ainote-5muq.onrender.com`; `login`, `call`, and the MCP server all share it, since stored credentials are keyed by host)
+- `AINOTE_API_URL` — backend URL (default `https://api.ainote.dev`; `login`, `call`, and the MCP server all share it, since stored credentials are keyed by host)
 - `AINOTE_API_KEY` — pre-provisioned MCP key. When set, the login flow is bypassed entirely and this key is used as-is.
 
 ### Headless / CI usage
@@ -437,7 +437,7 @@ By default the server listens on `http://localhost:3030` and exposes two endpoin
 Environment variable | Description | Default
 ---|---|---
 `AINOTE_API_KEY` | API key used for MCP key authentication | **required**
-`AINOTE_API_URL` | Target AI Note API base URL | `https://ainote-5muq.onrender.com`
+`AINOTE_API_URL` | Target AI Note API base URL | `https://api.ainote.dev`
 `AINOTE_MCP_HTTP_PORT` | Local port for the SSE server | `3030`
 `AINOTE_MCP_ALLOWED_ORIGINS` | Comma-separated list of allowed browser origins | _any_
 `AINOTE_MCP_ALLOWED_HOSTS` | Comma-separated list of allowed `Host` headers | _any_

package/lib/auth/token-store.js

@@ -26,6 +26,7 @@ import path from 'node:path';
 import os from 'node:os';
 import url from 'node:url';
 import { createRequire } from 'node:module';
+import { DEFAULT_API_URL, LEGACY_API_HOSTS } from '../core/config-manager.js';
 
 const require = createRequire(import.meta.url);
 
@@ -188,6 +189,47 @@ async function keychainDelete(apiUrl, field) {
  *   refreshToken?: string, expiresAt?: number, source: 'keychain'|'file'|'mixed'}>}
  */
 export async function getCredentials(apiUrl) {
+  const own = await readCredentials(apiUrl);
+  // Credentials saved while the default was a legacy host still count for the
+  // default host, so a host move does not force everyone to log in again.
+  // Merge per field, own values winning: a token refresh stores only the new
+  // access/refresh tokens under the current host, and the MCP key saved under
+  // the legacy host must stay visible after that.
+  let merged = own;
+  for (const legacyUrl of legacyUrlsFor(apiUrl)) {
+    const legacy = await readCredentials(legacyUrl);
+    if (!legacy) continue;
+    merged = merged ? mergeCredentials(merged, legacy) : legacy;
+  }
+  return merged;
+}
+
+function mergeCredentials(primary, fallback) {
+  const out = { ...primary };
+  for (const key of ['mcpKey', 'accessToken', 'refreshToken', 'expiresAt']) {
+    if (out[key] === undefined && fallback[key] !== undefined) out[key] = fallback[key];
+  }
+  if (out.source !== fallback.source) out.source = 'mixed';
+  return out;
+}
+
+/**
+ * Legacy API URLs whose stored credentials belong to `apiUrl`. Only the exact
+ * canonical HTTPS origin qualifies, so a plain-http or other-port URL on the
+ * same host never receives them.
+ */
+function legacyUrlsFor(apiUrl) {
+  let origin;
+  try {
+    origin = new url.URL(apiUrl).origin;
+  } catch {
+    return [];
+  }
+  if (origin !== new url.URL(DEFAULT_API_URL).origin) return [];
+  return LEGACY_API_HOSTS.map((host) => `https://${host}`);
+}
+
+async function readCredentials(apiUrl) {
   const host = apiHost(apiUrl);
 
   const fileStore = readFileStore();
@@ -287,6 +329,15 @@ export async function setCredentials(apiUrl, creds) {
  * Best-effort: errors are swallowed and the caller can assume cleared state.
  */
 export async function clearCredentials(apiUrl) {
+  // Logging out of the current host also drops legacy-host credentials;
+  // otherwise getCredentials() would fall back to them and resurrect the login.
+  for (const legacyUrl of legacyUrlsFor(apiUrl)) {
+    await clearHostCredentials(legacyUrl);
+  }
+  await clearHostCredentials(apiUrl);
+}
+
+async function clearHostCredentials(apiUrl) {
   const host = apiHost(apiUrl);
 
   for (const field of FIELDS) {

package/lib/core/config-manager.js

@@ -6,17 +6,41 @@
  * `ainote-mcp login` are namespaced by API host in the token store, so any
  * divergence here makes the other commands look up the wrong host.
  *
- * (api.ainote.dev is currently a CNAME to this same Render service, but it is
- * a different token-store key, so the default must stay identical everywhere.)
+ * The backend moved off Render (2026-11); the old Render host now answers 503.
+ * api.ainote.dev is the canonical domain, matching the iOS and Android apps.
  */
-export const DEFAULT_API_URL = 'https://ainote-5muq.onrender.com';
+export const DEFAULT_API_URL = 'https://api.ainote.dev';
+
+/**
+ * Hosts that used to serve the API. A URL on one of these is rewritten to
+ * DEFAULT_API_URL (path kept), so configs that pinned the old host via
+ * AINOTE_API_URL keep working, and the token store can still find
+ * credentials saved under them.
+ */
+export const LEGACY_API_HOSTS = ['ainote-5muq.onrender.com'];
+
+function rewriteLegacyHost(raw) {
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return raw;
+  }
+  if (!LEGACY_API_HOSTS.includes(parsed.host)) return raw;
+  const target = new URL(DEFAULT_API_URL);
+  parsed.protocol = target.protocol;
+  parsed.host = target.host;
+  return parsed.toString();
+}
 
 /**
  * Resolve the effective API base URL: AINOTE_API_URL env override, else the
- * default. Trailing slashes are stripped so "${url}/api/..." joins cleanly.
+ * default. A legacy host is rewritten to the default host. Trailing slashes
+ * are stripped so "${url}/api/..." joins cleanly.
  */
 export function resolveApiUrl(env = process.env) {
-  return (env.AINOTE_API_URL || DEFAULT_API_URL).replace(/\/+$/, '');
+  const raw = env.AINOTE_API_URL || DEFAULT_API_URL;
+  return rewriteLegacyHost(raw).replace(/\/+$/, '');
 }
 
 const DEFAULT_HTTP_PORT = 3030;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainote/mcp",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "mcpName": "io.github.seunghan91/ainote",
   "description": "MCP server for AI Note - Tasks, Dev Docs, and multi-device file sync (CLAUDE.md, memory files, Cursor rules, Windsurf rules)",
   "main": "index.js",