@lanonasis/cli 3.9.2 → 3.9.3

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog - @lanonasis/cli
 
+## [3.9.3] - 2026-02-02
+
+### ✨ Features
+
+- **Non-Interactive Vendor Key Auth**: Added `-k, --vendor-key <key>` option to `auth login` command
+  - Enables non-interactive authentication in CI/CD pipelines and automation scripts
+  - Example: `onasis auth login --vendor-key <your-key>`
+
+### 🐛 Bug Fixes
+
+- **JWT Authentication Routing**: Fixed API routing for JWT/OAuth authenticated sessions
+  - JWT tokens from username/password or OAuth login now correctly route to MCP server
+  - Memory operations (list, create, search, update, delete) work with JWT authentication
+  - Path translation handles endpoint differences between API and MCP servers
+  - Vendor key authentication continues to route to main API server
+
+- **Missing CLI Option**: The `--vendor-key` option was defined in code but not exposed in CLI
+  - Now properly registered in command-line interface
+
+### ⚠️ Known Limitations
+
+- `memory stats` command not available with JWT authentication (MCP server limitation)
+- For full API access including stats, use vendor key authentication
+
 ## [3.9.2] - 2026-02-02
 
 ### 🐛 Bug Fixes

package/dist/index.js

@@ -221,6 +221,7 @@ authCmd
     .description('Login to your MaaS account')
     .option('-e, --email <email>', 'email address')
     .option('-p, --password <password>', 'password')
+    .option('-k, --vendor-key <key>', 'vendor key for API access')
     .action(loginCommand);
 authCmd
     .command('logout')

package/dist/utils/api.js

@@ -15,19 +15,43 @@ export class APIClient {
             await this.config.init();
             // Service Discovery
             await this.config.discoverServices();
-            // Use appropriate base URL based on endpoint
+            // Use appropriate base URL based on endpoint and auth method
             const isAuthEndpoint = config.url?.includes('/auth/') || config.url?.includes('/login') || config.url?.includes('/register') || config.url?.includes('/oauth/');
             const discoveredServices = this.config.get('discoveredServices');
-            config.baseURL = isAuthEndpoint ?
-                (discoveredServices?.auth_base || 'https://auth.lanonasis.com') :
-                this.config.getApiUrl();
+            const authMethod = this.config.get('authMethod');
+            const vendorKey = await this.config.getVendorKeyAsync();
+            // Determine the correct API base URL:
+            // - Auth endpoints -> auth.lanonasis.com
+            // - JWT auth (no vendor key) -> mcp.lanonasis.com (supports JWT tokens)
+            // - Vendor key auth -> api.lanonasis.com (requires vendor key)
+            let apiBaseUrl;
+            const useMcpServer = !vendorKey && (authMethod === 'jwt' || authMethod === 'oauth' || authMethod === 'oauth2');
+            if (isAuthEndpoint) {
+                apiBaseUrl = discoveredServices?.auth_base || 'https://auth.lanonasis.com';
+            }
+            else if (vendorKey) {
+                // Vendor key works with api.lanonasis.com
+                apiBaseUrl = this.config.getApiUrl();
+            }
+            else if (useMcpServer) {
+                // JWT/OAuth tokens work with mcp.lanonasis.com
+                apiBaseUrl = 'https://mcp.lanonasis.com/api/v1';
+            }
+            else {
+                apiBaseUrl = this.config.getApiUrl();
+            }
+            config.baseURL = apiBaseUrl;
+            // Path translation for MCP server:
+            // MCP uses /memory (singular) while main API uses /memories (plural)
+            if (useMcpServer && config.url) {
+                config.url = config.url.replace(/\/api\/v1\/memories/g, '/memory');
+            }
             // Add project scope header for auth endpoints
             if (isAuthEndpoint) {
                 config.headers['X-Project-Scope'] = 'lanonasis-maas';
             }
             // Enhanced Authentication Support
             const token = this.config.getToken();
-            const vendorKey = await this.config.getVendorKeyAsync();
             if (vendorKey) {
                 // Vendor key authentication (validated server-side)
                 // Send raw key - server handles hashing for comparison

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.2",
+  "version": "3.9.3",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",