@lanonasis/cli 3.9.7 → 3.9.9

package/dist/mcp/schemas/tool-schemas.js

@@ -39,7 +39,7 @@ export const MemorySearchSchema = z.object({
     threshold: z.number()
         .min(0)
         .max(1)
-        .default(0.7)
+        .default(0.55)
         .describe("Similarity threshold (0-1)"),
     topic_id: z.string()
         .uuid()

package/dist/mcp/server/lanonasis-server.js

@@ -134,7 +134,7 @@ export class LanonasisMCPServer {
                                 type: 'number',
                                 minimum: 0,
                                 maximum: 1,
-                                default: 0.7,
+                                default: 0.55,
                                 description: 'Similarity threshold'
                             }
                         },
@@ -589,7 +589,7 @@ Tags: [Optional comma-separated tags]`
                 
 Query: ${args?.query || '[Enter search terms]'}
 Limit: [Number of results, default 10]
-Threshold: [Similarity threshold 0-1, default 0.7]`
+Threshold: [Similarity threshold 0-1, default 0.55]`
                             }
                         }
                     ]

package/dist/utils/api.d.ts

@@ -22,6 +22,7 @@ export interface LoginRequest {
     password: string;
 }
 export type MemoryType = 'context' | 'project' | 'knowledge' | 'reference' | 'personal' | 'workflow';
+export type WriteIntent = 'new' | 'continue' | 'auto';
 export interface MemoryEntry {
     id: string;
     title: string;
@@ -29,6 +30,7 @@ export interface MemoryEntry {
     memory_type: MemoryType;
     tags: string[];
     topic_id?: string | null;
+    topic_key?: string | null;
     user_id: string;
     organization_id: string;
     metadata?: Record<string, unknown>;
@@ -43,7 +45,11 @@ export interface CreateMemoryRequest {
     memory_type?: MemoryType;
     tags?: string[];
     topic_id?: string;
+    topic_key?: string;
     metadata?: Record<string, unknown>;
+    continuity_key?: string;
+    idempotency_key?: string;
+    write_intent?: WriteIntent;
 }
 export interface UpdateMemoryRequest {
     title?: string;
@@ -51,7 +57,11 @@ export interface UpdateMemoryRequest {
     memory_type?: MemoryType;
     tags?: string[];
     topic_id?: string | null;
+    topic_key?: string;
     metadata?: Record<string, unknown>;
+    continuity_key?: string;
+    idempotency_key?: string;
+    write_intent?: WriteIntent;
 }
 export interface GetMemoriesParams {
     page?: number;
@@ -60,6 +70,8 @@ export interface GetMemoriesParams {
     memory_type?: MemoryType;
     tags?: string[] | string;
     topic_id?: string;
+    topic_key?: string;
+    include_deleted?: boolean;
     user_id?: string;
     sort?: 'created_at' | 'updated_at' | 'last_accessed' | 'access_count' | 'title';
     order?: 'asc' | 'desc';
@@ -71,11 +83,14 @@ export interface SearchMemoryRequest {
     memory_types?: MemoryType[];
     tags?: string[];
     topic_id?: string;
+    topic_key?: string;
     limit?: number;
     threshold?: number;
+    include_deleted?: boolean;
+    response_mode?: 'full' | 'compact' | 'timeline';
 }
 export interface MemorySearchResult extends MemoryEntry {
-    relevance_score: number;
+    similarity_score: number;
 }
 export interface MemoryStats {
     total_memories: number;
@@ -172,6 +187,12 @@ export declare class APIClient {
     noExit: boolean;
     private normalizeMemoryEntry;
     private shouldUseLegacyMemoryRpcFallback;
+    private shouldRetryViaApiGateway;
+    private shouldRetryViaSupabaseMemoryFunctions;
+    private shouldUsePostListFallback;
+    private getSupabaseFunctionsBaseUrl;
+    private mapMemoryApiRouteToSupabaseFunctions;
+    private normalizeMcpPathToApi;
     constructor();
     login(email: string, password: string): Promise<AuthResponse>;
     register(email: string, password: string, organizationName?: string): Promise<AuthResponse>;

package/dist/utils/api.js

@@ -42,6 +42,155 @@ export class APIClient {
         }
         return false;
     }
+    shouldRetryViaApiGateway(error) {
+        const baseURL = String(error?.config?.baseURL || '');
+        const code = String(error?.code || '');
+        const alreadyRetried = Boolean(error?.config?.__retriedViaApiGateway);
+        if (alreadyRetried)
+            return false;
+        if (!baseURL.includes('mcp.lanonasis.com'))
+            return false;
+        return code === 'ENOTFOUND' || code === 'EAI_AGAIN' || code === 'ECONNREFUSED';
+    }
+    shouldRetryViaSupabaseMemoryFunctions(error) {
+        const status = Number(error?.response?.status || 0);
+        if (status !== 401 && status !== 404)
+            return false;
+        const cfg = (error?.config || {});
+        if (cfg.__retriedViaSupabaseMemoryFunctions || cfg.__useSupabaseMemoryFunctions)
+            return false;
+        const baseURL = String(cfg.baseURL || '');
+        if (baseURL.includes('supabase.co'))
+            return false;
+        const requestUrl = String(cfg.url || '');
+        const normalizedRequestUrl = requestUrl.startsWith('/memory')
+            ? this.normalizeMcpPathToApi(requestUrl)
+            : requestUrl;
+        if (!normalizedRequestUrl.startsWith('/api/v1/memories'))
+            return false;
+        const errorData = error?.response?.data;
+        const responseText = typeof errorData === 'string'
+            ? errorData
+            : `${errorData?.message || ''} ${errorData?.error || ''}`;
+        if (status === 401) {
+            const indicatesRouteShapeDrift = /invalid jwt|missing authorization header|authentication required|token is not active or has expired/i
+                .test(responseText);
+            if (!indicatesRouteShapeDrift)
+                return false;
+        }
+        if (status === 404) {
+            const isGetByIdRequest = /^\/api\/v1\/memories\/[^/?#]+$/.test(normalizedRequestUrl);
+            const indicatesMissingMcpGetRoute = /cannot get \/api\/v1\/memory\/|cannot get \/memory\/|route[_ -]?not[_ -]?found/i
+                .test(responseText.toLowerCase());
+            if (!isGetByIdRequest || !indicatesMissingMcpGetRoute)
+                return false;
+        }
+        const authMethod = String(this.config.get('authMethod') || '');
+        const token = this.config.getToken();
+        const hasOpaqueToken = Boolean(token) && token.split('.').length !== 3;
+        const hasVendorKey = this.config.hasVendorKey();
+        return hasVendorKey || hasOpaqueToken || authMethod === 'oauth' || authMethod === 'oauth2';
+    }
+    shouldUsePostListFallback(error) {
+        const status = Number(error?.response?.status || 0);
+        if (status === 405)
+            return true;
+        if (status !== 401)
+            return false;
+        const message = String(error?.response?.data?.message || error?.response?.data?.error || '');
+        return /missing authorization header|authentication required/i.test(message);
+    }
+    getSupabaseFunctionsBaseUrl() {
+        const discoveredServices = this.config.get('discoveredServices');
+        const candidates = [
+            process.env.LANONASIS_SUPABASE_URL,
+            process.env.SUPABASE_URL,
+            discoveredServices?.memory_base
+        ];
+        for (const candidate of candidates) {
+            if (typeof candidate === 'string'
+                && candidate.includes('supabase.co')
+                && !candidate.includes('your-project.supabase.co')
+                && !candidate.includes('<project-ref>.supabase.co')) {
+                return candidate.replace(/\/$/, '');
+            }
+        }
+        return 'https://lanonasis.supabase.co';
+    }
+    mapMemoryApiRouteToSupabaseFunctions(config, token, vendorKey) {
+        const method = String(config.method || 'get').toLowerCase();
+        const rawUrl = String(config.url || '');
+        const url = rawUrl.startsWith('/memory')
+            ? this.normalizeMcpPathToApi(rawUrl)
+            : rawUrl;
+        const mapped = config;
+        mapped.baseURL = this.getSupabaseFunctionsBaseUrl();
+        mapped.headers = mapped.headers || {};
+        if (token) {
+            mapped.headers.Authorization = `Bearer ${token}`;
+            delete mapped.headers['X-API-Key'];
+        }
+        else if (vendorKey) {
+            mapped.headers['X-API-Key'] = vendorKey;
+        }
+        // Supabase functions do not need X-Auth-Method and can reject unexpected values.
+        delete mapped.headers['X-Auth-Method'];
+        mapped.headers['X-Project-Scope'] = 'lanonasis-maas';
+        if (method === 'get' && url === '/api/v1/memories') {
+            mapped.url = '/functions/v1/memory-list';
+            return mapped;
+        }
+        if (method === 'post' && url === '/api/v1/memories') {
+            mapped.url = '/functions/v1/memory-create';
+            return mapped;
+        }
+        if (method === 'post' && url === '/api/v1/memories/search') {
+            mapped.url = '/functions/v1/memory-search';
+            return mapped;
+        }
+        if (method === 'get' && url === '/api/v1/memories/stats') {
+            mapped.url = '/functions/v1/memory-stats';
+            return mapped;
+        }
+        if (method === 'post' && url === '/api/v1/memories/bulk/delete') {
+            mapped.url = '/functions/v1/memory-bulk-delete';
+            return mapped;
+        }
+        const idMatch = url.match(/^\/api\/v1\/memories\/([^/?#]+)$/);
+        if (idMatch) {
+            const id = decodeURIComponent(idMatch[1] || '');
+            if (method === 'get') {
+                mapped.url = '/functions/v1/memory-get';
+                mapped.params = { ...(config.params || {}), id };
+                return mapped;
+            }
+            if (method === 'put' || method === 'patch') {
+                mapped.method = 'post';
+                mapped.url = '/functions/v1/memory-update';
+                const body = (config.data && typeof config.data === 'object')
+                    ? config.data
+                    : {};
+                mapped.data = { id, ...body };
+                return mapped;
+            }
+            if (method === 'delete') {
+                mapped.url = '/functions/v1/memory-delete';
+                mapped.params = { ...(config.params || {}), id };
+                return mapped;
+            }
+        }
+        return mapped;
+    }
+    normalizeMcpPathToApi(url) {
+        // MCP HTTP compatibility path -> API gateway REST paths
+        if (url === '/memory') {
+            return '/api/v1/memories';
+        }
+        if (url.startsWith('/memory/')) {
+            return url.replace('/memory/', '/api/v1/memories/');
+        }
+        return url;
+    }
     constructor() {
         this.config = new CLIConfig();
         this.client = axios.create({
@@ -60,31 +209,50 @@ export class APIClient {
             const authMethod = this.config.get('authMethod');
             const vendorKey = await this.config.getVendorKeyAsync();
             const token = this.config.getToken();
-            const isMemoryEndpoint = typeof config.url === 'string' && config.url.startsWith('/api/v1/memories');
+            const useSupabaseMemoryFunctions = config.__useSupabaseMemoryFunctions === true;
+            const normalizedMemoryUrl = typeof config.url === 'string'
+                ? this.normalizeMcpPathToApi(config.url)
+                : '';
+            const isMemoryEndpoint = normalizedMemoryUrl.startsWith('/api/v1/memories');
             const forceApiFromEnv = process.env.LANONASIS_FORCE_API === 'true'
                 || process.env.CLI_FORCE_API === 'true'
                 || process.env.ONASIS_FORCE_API === 'true';
             const forceApiFromConfig = this.config.get('forceApi') === true
                 || this.config.get('connectionTransport') === 'api';
-            // Memory CRUD/search endpoints should always use the API gateway path.
-            const forceDirectApi = forceApiFromEnv || forceApiFromConfig || isMemoryEndpoint;
+            if (useSupabaseMemoryFunctions && isMemoryEndpoint) {
+                const remapped = this.mapMemoryApiRouteToSupabaseFunctions(config, token || undefined, vendorKey || undefined);
+                if (process.env.CLI_VERBOSE === 'true') {
+                    const requestId = randomUUID();
+                    remapped.headers['X-Request-ID'] = requestId;
+                    remapped.headers['X-Transport-Mode'] = 'supabase-functions-fallback';
+                    console.log(chalk.dim(`→ ${String(remapped.method || 'get').toUpperCase()} ${remapped.url} [${requestId}]`));
+                    console.log(chalk.dim(`  transport=supabase-functions-fallback baseURL=${remapped.baseURL}`));
+                }
+                return remapped;
+            }
+            const forceDirectApiRetry = config
+                .__forceDirectApiGatewayRetry === true;
+            // NOTE: isMemoryEndpoint is intentionally NOT in forceDirectApi.
+            // api.lanonasis.com is the vendor AI proxy, NOT the memory service.
+            // Memory operations must go to mcp.lanonasis.com.
+            const forceDirectApi = forceApiFromEnv || forceApiFromConfig || forceDirectApiRetry;
             const prefersTokenAuth = Boolean(token) && (authMethod === 'jwt' || authMethod === 'oauth' || authMethod === 'oauth2');
             const useVendorKeyAuth = Boolean(vendorKey) && !prefersTokenAuth;
             // Determine the correct API base URL:
             // - Auth endpoints -> auth.lanonasis.com
-            // - JWT auth (no vendor key) -> mcp.lanonasis.com (supports JWT tokens)
-            // - Vendor key auth -> api.lanonasis.com (requires vendor key)
+            // - Memory/MCP operations (JWT or vendor key) -> mcp.lanonasis.com (the memory service)
+            // - Other direct API calls -> api.lanonasis.com (vendor AI proxy)
             let apiBaseUrl;
-            const useMcpServer = !forceDirectApi && prefersTokenAuth && !useVendorKeyAuth;
+            const useMcpServer = !forceDirectApi && !isAuthEndpoint && (prefersTokenAuth || useVendorKeyAuth || isMemoryEndpoint);
             if (isAuthEndpoint) {
                 apiBaseUrl = discoveredServices?.auth_base || 'https://auth.lanonasis.com';
             }
             else if (forceDirectApi) {
-                // Force direct REST API mode to bypass MCP routing for troubleshooting.
+                // Explicit force: direct to api.lanonasis.com for troubleshooting.
                 apiBaseUrl = this.config.getApiUrl();
             }
             else if (useMcpServer) {
-                // JWT/OAuth tokens work with mcp.lanonasis.com
+                // Memory service lives at mcp.lanonasis.com — accepts JWT, OAuth, and vendor keys.
                 apiBaseUrl = 'https://mcp.lanonasis.com/api/v1';
             }
             else {
@@ -101,9 +269,7 @@ export class APIClient {
                 config.headers['X-Project-Scope'] = 'lanonasis-maas';
             }
             // Enhanced Authentication Support
-            // Even in forced direct-API mode, prefer bearer token auth when available.
-            // This avoids accidentally sending an OAuth access token as X-API-Key (we store it
-            // in secure storage for MCP/WebSocket usage), which can cause 401s.
+            // In forced direct-API mode, prefer bearer token auth when available.
             const preferVendorKeyInDirectApiMode = forceDirectApi && Boolean(vendorKey) && !prefersTokenAuth;
             if (preferVendorKeyInDirectApiMode) {
                 // Vendor key authentication (validated server-side)
@@ -147,6 +313,26 @@ export class APIClient {
             }
             return response;
         }, (error) => {
+            if (this.shouldRetryViaSupabaseMemoryFunctions(error)) {
+                const retryConfig = {
+                    ...error.config,
+                    __retriedViaSupabaseMemoryFunctions: true,
+                    __useSupabaseMemoryFunctions: true
+                };
+                return this.client.request(retryConfig);
+            }
+            if (this.shouldRetryViaApiGateway(error)) {
+                const retryConfig = {
+                    ...error.config,
+                    __retriedViaApiGateway: true,
+                    __forceDirectApiGatewayRetry: true
+                };
+                retryConfig.baseURL = this.config.getApiUrl();
+                if (typeof retryConfig.url === 'string') {
+                    retryConfig.url = this.normalizeMcpPathToApi(retryConfig.url);
+                }
+                return this.client.request(retryConfig);
+            }
             if (error.response) {
                 const { status, data } = error.response;
                 if (status === 401) {
@@ -213,7 +399,7 @@ export class APIClient {
         }
         catch (error) {
             // Backward-compatible fallback: newer API contracts may reject GET list.
-            if (error?.response?.status === 405) {
+            if (this.shouldUsePostListFallback(error)) {
                 const limit = Number(params.limit || 20);
                 const page = Number(params.page || 1);
                 const offset = Number(params.offset ?? Math.max(0, (page - 1) * limit));

package/dist/utils/config.d.ts

@@ -26,7 +26,7 @@ interface CLIConfigData {
     manualEndpointOverrides?: boolean;
     lastManualEndpointUpdate?: string;
     vendorKey?: string | undefined;
-    authMethod?: 'jwt' | 'vendor_key' | 'oauth' | undefined;
+    authMethod?: 'jwt' | 'vendor_key' | 'oauth' | 'oauth2' | undefined;
     tokenExpiry?: number | undefined;
     lastValidated?: string | undefined;
     deviceId?: string;
@@ -84,10 +84,14 @@ export declare class CLIConfig {
     setManualEndpoints(endpoints: Partial<CLIConfigData['discoveredServices']>): Promise<void>;
     hasManualEndpointOverrides(): boolean;
     /**
-     * Clears the in-memory auth cache and removes the `lastValidated` timestamp.
-     * Called after a definitive 401 from the memory API so that the next
-     * `isAuthenticated()` call performs a fresh server verification rather than
-     * returning a stale cached result.
+     * Clears the in-memory auth cache so that the next `isAuthenticated()` call
+     * performs a fresh server verification rather than returning a stale cached result.
+     *
+     * NOTE: `lastValidated` is intentionally NOT deleted here. Each auth path
+     * (vendor_key, token) already correctly rejects 401 responses without relying
+     * on `lastValidated`. Deleting it would destroy the offline grace period
+     * (7-day for vendor keys, 24-hour for JWT tokens), causing auth failures
+     * on transient network errors even when credentials are valid.
      */
     invalidateAuthCache(): Promise<void>;
     clearManualEndpointOverrides(): Promise<void>;
@@ -111,6 +115,7 @@ export declare class CLIConfig {
     setApiUrl(url: string): Promise<void>;
     setToken(token: string): Promise<void>;
     getToken(): string | undefined;
+    getAuthMethod(): string | undefined;
     getCurrentUser(): Promise<UserProfile | undefined>;
     isAuthenticated(): Promise<boolean>;
     logout(): Promise<void>;

package/dist/utils/config.js

@@ -670,15 +670,17 @@ export class CLIConfig {
         return !!this.config.manualEndpointOverrides;
     }
     /**
-     * Clears the in-memory auth cache and removes the `lastValidated` timestamp.
-     * Called after a definitive 401 from the memory API so that the next
-     * `isAuthenticated()` call performs a fresh server verification rather than
-     * returning a stale cached result.
+     * Clears the in-memory auth cache so that the next `isAuthenticated()` call
+     * performs a fresh server verification rather than returning a stale cached result.
+     *
+     * NOTE: `lastValidated` is intentionally NOT deleted here. Each auth path
+     * (vendor_key, token) already correctly rejects 401 responses without relying
+     * on `lastValidated`. Deleting it would destroy the offline grace period
+     * (7-day for vendor keys, 24-hour for JWT tokens), causing auth failures
+     * on transient network errors even when credentials are valid.
      */
     async invalidateAuthCache() {
         this.authCheckCache = null;
-        delete this.config.lastValidated;
-        await this.save().catch(() => { });
     }
     async clearManualEndpointOverrides() {
         delete this.config.manualEndpointOverrides;
@@ -894,6 +896,9 @@ export class CLIConfig {
     getToken() {
         return this.config.token;
     }
+    getAuthMethod() {
+        return this.config.authMethod;
+    }
     async getCurrentUser() {
         return this.config.user;
     }
@@ -962,15 +967,20 @@ export class CLIConfig {
         const token = this.getToken();
         if (!token)
             return false;
-        // OAuth tokens are often opaque (not JWT). Prefer local expiry metadata when present.
-        if (this.config.authMethod === 'oauth') {
+        // OAuth tokens are often opaque (not JWT). Use local expiry metadata as a quick
+        // pre-check, but do not treat it as authoritative for a "true" result. We still
+        // run server verification on cache misses to avoid status/API drift.
+        let oauthTokenLocallyValid;
+        if (this.config.authMethod === 'oauth' || this.config.authMethod === 'oauth2') {
             const tokenExpiresAt = this.get('token_expires_at');
             if (typeof tokenExpiresAt === 'number') {
-                const isValid = Date.now() < tokenExpiresAt;
-                this.authCheckCache = { isValid, timestamp: Date.now() };
-                return isValid;
+                oauthTokenLocallyValid = Date.now() < tokenExpiresAt;
+                if (!oauthTokenLocallyValid) {
+                    this.authCheckCache = { isValid: false, timestamp: Date.now() };
+                    return false;
+                }
             }
-            // Fall through to legacy validation when we don't have expiry metadata.
+            // Fall through to server validation path.
         }
         // Check cache first
         if (this.authCheckCache && (Date.now() - this.authCheckCache.timestamp) < this.AUTH_CACHE_TTL) {
@@ -978,9 +988,11 @@ export class CLIConfig {
         }
         // Local expiry check first (fast)
         let locallyValid = false;
-        // Handle simple CLI tokens (format: cli_xxx_timestamp)
-        if (token.startsWith('cli_')) {
-            // Extract timestamp from CLI token
+        if (typeof oauthTokenLocallyValid === 'boolean') {
+            locallyValid = oauthTokenLocallyValid;
+        }
+        else if (token.startsWith('cli_')) {
+            // Handle simple CLI tokens (format: cli_xxx_timestamp)
             const parts = token.split('_');
             if (parts.length >= 3) {
                 const lastPart = parts[parts.length - 1];
@@ -1033,17 +1045,7 @@ export class CLIConfig {
             this.authCheckCache = { isValid: false, timestamp: Date.now() };
             return false;
         }
-        // Token is locally valid - check if we need server validation
-        // Skip server validation if we have a recent lastValidated timestamp (within 24 hours)
-        const lastValidated = this.config.lastValidated;
-        const skipServerValidation = lastValidated &&
-            (Date.now() - new Date(lastValidated).getTime()) < (24 * 60 * 60 * 1000); // 24 hours
-        if (skipServerValidation) {
-            // Trust the local validation if it was recently validated
-            this.authCheckCache = { isValid: locallyValid, timestamp: Date.now() };
-            return locallyValid;
-        }
-        // Verify with server (security check) for tokens that haven't been validated recently
+        // Token is locally valid - verify with server on cache miss for consistency
         try {
             // Try auth-gateway first (port 4000), then fall back to Netlify function
             const endpoints = [
@@ -1059,16 +1061,25 @@ export class CLIConfig {
                     if (response.data.valid === true) {
                         break;
                     }
-                    // Server explicitly said invalid - this is an auth error, not network error
+                    // Explicit auth rejection should always invalidate local auth state.
                     if (response.status === 401 || response.status === 403 || response.data.valid === false) {
                         authError = true;
                     }
+                    else {
+                        // Non-auth failures (like 404/5xx) should behave like transient verification failures.
+                        networkError = true;
+                    }
                 }
                 catch (error) {
-                    // Check if this is a network error (no response) vs auth error (got response)
+                    // Check if this is a network/transient error vs explicit auth rejection.
                     if (error.response) {
-                        // Got a response, likely 401/403
-                        authError = true;
+                        const status = error.response.status;
+                        if (status === 401 || status === 403) {
+                            authError = true;
+                        }
+                        else {
+                            networkError = true;
+                        }
                     }
                     else {
                         // Network error (ECONNREFUSED, ETIMEDOUT, etc.)
@@ -1196,6 +1207,12 @@ export class CLIConfig {
             return;
         }
         try {
+            // Vendor-key sessions should never attempt token refresh.
+            // Some environments retain stale token/refresh_token fields from older logins,
+            // which can otherwise trip dead refresh routes during normal memory commands.
+            if (String(this.config.authMethod || '').toLowerCase() === 'vendor_key') {
+                return;
+            }
             // OAuth token refresh (opaque tokens + refresh_token + token_expires_at)
             if (this.config.authMethod === 'oauth') {
                 const refreshToken = this.get('refresh_token');
@@ -1376,8 +1393,25 @@ export class CLIConfig {
             'wss://mcp.lanonasis.com/ws';
     }
     getMCPRestUrl() {
-        return this.config.discoveredServices?.mcp_base ||
-            'https://mcp.lanonasis.com/api/v1';
+        const configured = this.config.mcpServerUrl;
+        if (typeof configured === 'string' && configured.trim().length > 0) {
+            return configured.trim();
+        }
+        const discoveredMcpBase = this.config.discoveredServices?.mcp_base;
+        if (typeof discoveredMcpBase === 'string' && discoveredMcpBase.trim().length > 0) {
+            const normalizedMcpBase = discoveredMcpBase.trim().replace(/\/$/, '');
+            const normalizedMemoryBase = (this.config.discoveredServices?.memory_base || '')
+                .toString()
+                .trim()
+                .replace(/\/$/, '');
+            // Guard against service-discovery payloads that map MCP REST to the memory API host.
+            const pointsToMemoryBase = normalizedMemoryBase.length > 0 &&
+                normalizedMcpBase.replace(/\/api\/v1$/, '') === normalizedMemoryBase;
+            if (!pointsToMemoryBase) {
+                return normalizedMcpBase;
+            }
+        }
+        return 'https://mcp.lanonasis.com/api/v1';
     }
     getMCPSSEUrl() {
         return this.config.discoveredServices?.mcp_sse_base ||

package/dist/utils/mcp-client.d.ts

@@ -112,6 +112,8 @@ export declare class MCPClient {
      * Calculate exponential backoff delay with jitter
      */
     private exponentialBackoff;
+    private resolveAuthCredential;
+    private buildAuthHeaders;
     /**
      * Validate authentication credentials before attempting MCP connection
      */