@lanonasis/cli 3.9.8 → 3.9.9

package/dist/commands/api-keys.js

@@ -162,7 +162,7 @@ apiKeysCommand
                     validate: (input) => input.length > 0 || 'Value is required'
                 },
                 {
-                    type: 'list',
+                    type: 'select',
                     name: 'keyType',
                     message: 'Key type:',
                     when: !keyData.keyType,
@@ -177,21 +177,21 @@ apiKeysCommand
                     ]
                 },
                 {
-                    type: 'list',
+                    type: 'select',
                     name: 'environment',
                     message: 'Environment:',
                     choices: ['development', 'staging', 'production'],
                     default: 'development'
                 },
                 {
-                    type: 'list',
+                    type: 'select',
                     name: 'projectId',
                     message: 'Select project:',
                     when: !keyData.projectId && projects.length > 0,
                     choices: projects.map((p) => ({ name: `${p.name} (${p.id})`, value: p.id }))
                 },
                 {
-                    type: 'list',
+                    type: 'select',
                     name: 'accessLevel',
                     message: 'Access level:',
                     choices: ['public', 'authenticated', 'team', 'admin', 'enterprise'],
@@ -543,7 +543,7 @@ mcpCommand
                     default: false
                 },
                 {
-                    type: 'list',
+                    type: 'select',
                     name: 'riskLevel',
                     message: 'Risk level:',
                     choices: ['low', 'medium', 'high', 'critical'],
@@ -647,7 +647,7 @@ mcpCommand
             const tools = await apiClient.get('/api-keys/mcp/tools');
             const answers = await inquirer.prompt([
                 {
-                    type: 'list',
+                    type: 'select',
                     name: 'toolId',
                     message: 'Select MCP tool:',
                     when: !requestData.toolId && tools.length > 0,
@@ -672,7 +672,7 @@ mcpCommand
                     validate: (input) => input.length > 0 || 'At least one key name is required'
                 },
                 {
-                    type: 'list',
+                    type: 'select',
                     name: 'environment',
                     message: 'Environment:',
                     when: !requestData.environment,

package/dist/commands/auth.js

@@ -569,7 +569,7 @@ export async function loginCommand(options) {
     // Show authentication options
     const authChoice = await inquirer.prompt([
         {
-            type: 'list',
+            type: 'select',
             name: 'method',
             message: 'Choose authentication method:',
             choices: [
@@ -821,7 +821,7 @@ async function handleCredentialsFlow(options, config) {
         }
         // Store JWT token for API authentication
         await config.setToken(authToken);
-        await config.set('authMethod', 'jwt');
+        await config.setAndSave('authMethod', 'jwt');
         spinner.succeed('Login successful');
         console.log();
         console.log(chalk.green('✓ Authenticated successfully'));

package/dist/commands/guide.js

@@ -188,7 +188,7 @@ export class UserGuidanceSystem {
                 default: 'https://api.lanonasis.com/api/v1'
             },
             {
-                type: 'list',
+                type: 'select',
                 name: 'outputFormat',
                 message: 'Preferred output format:',
                 choices: ['table', 'json', 'yaml', 'csv'],
@@ -206,7 +206,7 @@ export class UserGuidanceSystem {
         console.log();
         const { authMethod } = await inquirer.prompt([
             {
-                type: 'list',
+                type: 'select',
                 name: 'authMethod',
                 message: 'Choose authentication method:',
                 choices: [
@@ -335,7 +335,7 @@ export class UserGuidanceSystem {
         console.log();
         const { shell } = await inquirer.prompt([
             {
-                type: 'list',
+                type: 'select',
                 name: 'shell',
                 message: 'Which shell do you use?',
                 choices: [

package/dist/commands/mcp.js

@@ -4,9 +4,42 @@ import { table } from 'table';
 import { getMCPClient } from '../utils/mcp-client.js';
 import { EnhancedMCPClient } from '../mcp/client/enhanced-client.js';
 import { CLIConfig } from '../utils/config.js';
+import { apiClient } from '../utils/api.js';
 import WebSocket from 'ws';
 import { dirname, join } from 'path';
 import { createConnectionManager } from '../ux/index.js';
+const tokenizeQuery = (input) => input
+    .toLowerCase()
+    .split(/[^a-z0-9]+/g)
+    .map((token) => token.trim())
+    .filter((token) => token.length >= 2);
+const lexicalScore = (query, memory) => {
+    const tokens = tokenizeQuery(query);
+    if (tokens.length === 0)
+        return 0;
+    const haystack = `${memory.title || ''} ${memory.content || ''} ${(memory.tags || []).join(' ')}`.toLowerCase();
+    const hits = tokens.filter((token) => haystack.includes(token)).length;
+    if (hits === 0)
+        return 0;
+    const ratio = hits / tokens.length;
+    return Math.max(0.35, Math.min(0.69, Number((ratio * 0.65).toFixed(3))));
+};
+const fallbackMemorySearch = async (query, limit) => {
+    const candidateLimit = Math.min(Math.max(limit * 8, 50), 200);
+    const memoriesResult = await apiClient.getMemories({ page: 1, limit: candidateLimit });
+    const candidates = (memoriesResult.memories || memoriesResult.data || []);
+    return candidates
+        .map((memory) => ({
+        id: memory.id,
+        title: memory.title,
+        memory_type: memory.memory_type,
+        similarity_score: lexicalScore(query, memory),
+        content: memory.content || ''
+    }))
+        .filter((memory) => memory.similarity_score > 0)
+        .sort((a, b) => b.similarity_score - a.similarity_score)
+        .slice(0, limit);
+};
 /**
  * Register MCP-related CLI commands (mcp and mcp-server) on a Commander program.
  *
@@ -460,25 +493,54 @@ export function mcpCommands(program) {
     });
     memory.command('search')
         .description('Search memories via MCP')
-        .argument('<query>', 'Search query')
+        .argument('<query...>', 'Search query')
         .option('-l, --limit <number>', 'Maximum results', '10')
         .option('-t, --threshold <number>', 'Similarity threshold (0-1)', '0.55')
-        .action(async (query, options) => {
+        .action(async (queryParts, options) => {
+        const query = Array.isArray(queryParts) ? queryParts.join(' ').trim() : String(queryParts || '').trim();
+        if (!query) {
+            console.error(chalk.red('Search query is required'));
+            process.exit(1);
+        }
         const spinner = ora('Searching memories via MCP...').start();
+        const client = getMCPClient();
         try {
-            const client = getMCPClient();
             if (!client.isConnectedToServer()) {
                 spinner.info('Not connected. Attempting auto-connect...');
                 const config = new CLIConfig();
                 const useRemote = !!config.get('token');
                 await client.connect({ useRemote });
             }
-            const results = await client.callTool('memory_search_memories', {
-                query,
-                limit: parseInt(options.limit),
-                threshold: parseFloat(options.threshold)
-            });
-            spinner.succeed(`Found ${results.length} memories`);
+            const limit = parseInt(options.limit);
+            const threshold = parseFloat(options.threshold);
+            let results = [];
+            let usedLexicalFallback = false;
+            try {
+                const rawResult = await client.callTool('memory_search_memories', {
+                    query,
+                    limit,
+                    threshold
+                });
+                results = Array.isArray(rawResult)
+                    ? rawResult
+                    : Array.isArray(rawResult?.results)
+                        ? rawResult.results
+                        : Array.isArray(rawResult?.result)
+                            ? rawResult.result
+                            : [];
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                if (/vector dimensions|hybrid search failed|memory search failed/i.test(message)) {
+                    spinner.info('Semantic search unavailable in MCP path, using lexical fallback...');
+                    results = await fallbackMemorySearch(query, limit);
+                    usedLexicalFallback = true;
+                }
+                else {
+                    throw error;
+                }
+            }
+            spinner.succeed(`Found ${results.length} memories${usedLexicalFallback ? ' (lexical fallback)' : ''}`);
             if (results.length === 0) {
                 console.log(chalk.yellow('\nNo memories found matching your query'));
                 return;
@@ -496,6 +558,11 @@ export function mcpCommands(program) {
             spinner.fail(`Search failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
             process.exit(1);
         }
+        finally {
+            if (client.isConnectedToServer()) {
+                await client.disconnect().catch(() => { });
+            }
+        }
     });
     // Configure MCP preferences
     mcp.command('config')

package/dist/commands/memory.js

@@ -209,7 +209,10 @@ const createIntelligenceTransport = async () => {
     const authToken = config.getToken();
     const apiKey = await config.getVendorKeyAsync();
     const apiUrl = `${config.getApiUrl().replace(/\/$/, '')}/api/v1`;
-    if (authToken) {
+    const authMethod = config.getAuthMethod();
+    // When vendor_key is explicitly set, skip JWT even if a token exists in storage.
+    // JWT validates against auth-gateway's DB; vendor keys validate against mcp-core's DB.
+    if (authToken && authMethod !== 'vendor_key') {
         return {
             mode: 'sdk',
             client: new MemoryIntelligenceClient({
@@ -221,7 +224,7 @@ const createIntelligenceTransport = async () => {
         };
     }
     if (apiKey) {
-        if (apiKey.startsWith('lano_')) {
+        if (apiKey.startsWith('lano_') || apiKey.startsWith('lms_')) {
             return {
                 mode: 'sdk',
                 client: new MemoryIntelligenceClient({
@@ -232,7 +235,7 @@ const createIntelligenceTransport = async () => {
                 }),
             };
         }
-        // Legacy non-lano key path: use CLI API client auth middleware directly.
+        // Legacy key path: use CLI API client auth middleware directly.
         return { mode: 'api' };
     }
     throw new Error('Authentication required. Run "lanonasis auth login" first.');
@@ -324,7 +327,7 @@ export function memoryCommands(program) {
                         validate: (input) => input.length > 0 || 'Title is required',
                     },
                     {
-                        type: 'list',
+                        type: 'select',
                         name: 'type',
                         message: 'Memory type:',
                         choices: [...MEMORY_TYPE_CHOICES],
@@ -670,13 +673,18 @@ export function memoryCommands(program) {
     program
         .command('search')
         .description('Search memories using semantic search')
-        .argument('<query>', 'search query')
+        .argument('<query...>', 'search query')
         .option('-l, --limit <limit>', 'number of results', '20')
         .option('--threshold <threshold>', 'similarity threshold (0-1)', '0.55')
         .option('--type <types>', 'filter by memory types (comma-separated)')
         .option('--tags <tags>', 'filter by tags (comma-separated)')
-        .action(async (query, options) => {
+        .action(async (queryParts, options) => {
         try {
+            const query = Array.isArray(queryParts) ? queryParts.join(' ').trim() : String(queryParts || '').trim();
+            if (!query) {
+                console.error(chalk.red('✖ Search query is required'));
+                process.exit(1);
+            }
             const spinner = ora(`Searching for "${query}"...`).start();
             const requestedThreshold = clampThreshold(parseFloat(options.threshold || '0.55'));
             const searchOptions = {
@@ -694,20 +702,27 @@ export function memoryCommands(program) {
             let results = [];
             let thresholdUsed = requestedThreshold;
             let searchStrategy = 'semantic';
+            let semanticSearchError = null;
             for (const threshold of thresholdPlan) {
-                const attempt = await apiClient.searchMemories(query, {
-                    ...searchOptions,
-                    threshold,
-                });
-                const attemptResults = (attempt.results || attempt.data || []);
-                result = attempt;
-                if (attemptResults.length > 0) {
-                    results = attemptResults;
-                    thresholdUsed = threshold;
-                    const attemptStrategy = attempt.search_strategy;
-                    searchStrategy = typeof attemptStrategy === 'string'
-                        ? attemptStrategy
-                        : 'semantic';
+                try {
+                    const attempt = await apiClient.searchMemories(query, {
+                        ...searchOptions,
+                        threshold,
+                    });
+                    const attemptResults = (attempt.results || attempt.data || []);
+                    result = attempt;
+                    if (attemptResults.length > 0) {
+                        results = attemptResults;
+                        thresholdUsed = threshold;
+                        const attemptStrategy = attempt.search_strategy;
+                        searchStrategy = typeof attemptStrategy === 'string'
+                            ? attemptStrategy
+                            : 'semantic';
+                        break;
+                    }
+                }
+                catch (error) {
+                    semanticSearchError = error instanceof Error ? error.message : 'Unknown semantic search error';
                     break;
                 }
             }
@@ -721,11 +736,19 @@ export function memoryCommands(program) {
             spinner.stop();
             if (results.length === 0) {
                 console.log(chalk.yellow('No memories found matching your search'));
+                if (semanticSearchError) {
+                    console.log(chalk.gray(`Semantic search error: ${semanticSearchError}`));
+                }
                 console.log(chalk.gray(`Tried thresholds: ${thresholdPlan.map((t) => t.toFixed(2)).join(', ')}`));
                 return;
             }
-            console.log(chalk.blue.bold(`\n🔍 Search Results (${result.total_results || results.length} found)`));
-            console.log(chalk.gray(`Query: "${query}" | Search time: ${result.search_time_ms || 0}ms`));
+            if (semanticSearchError && searchStrategy === 'cli_lexical_fallback') {
+                console.log(chalk.yellow(`⚠ Semantic search unavailable, using lexical fallback (${semanticSearchError})`));
+            }
+            const totalResults = typeof result?.total_results === 'number' ? result.total_results : results.length;
+            const searchTimeMs = typeof result?.search_time_ms === 'number' ? result.search_time_ms : 0;
+            console.log(chalk.blue.bold(`\n🔍 Search Results (${totalResults} found)`));
+            console.log(chalk.gray(`Query: "${query}" | Search time: ${searchTimeMs}ms`));
             if (Math.abs(thresholdUsed - requestedThreshold) > 0.0001) {
                 console.log(chalk.gray(`No matches at ${requestedThreshold.toFixed(2)}; used adaptive threshold ${thresholdUsed.toFixed(2)}`));
             }
@@ -820,7 +843,7 @@ export function memoryCommands(program) {
                         default: currentMemory.title,
                     },
                     {
-                        type: 'list',
+                        type: 'select',
                         name: 'type',
                         message: 'Memory type:',
                         choices: [...MEMORY_TYPE_CHOICES],

package/dist/core/dashboard.js

@@ -280,7 +280,7 @@ export class InteractiveMemoryCreator {
             console.log(chalk.cyan(`📎 I noticed this looks like ${suggestions.contentType}. Would you like to:`));
             const { topicChoice } = await inquirer.prompt([
                 {
-                    type: 'list',
+                    type: 'select',
                     name: 'topicChoice',
                     message: 'Select topic:',
                     choices: [
@@ -336,7 +336,7 @@ export class InteractiveMemoryCreator {
         // Memory type selection
         const { memoryType } = await inquirer.prompt([
             {
-                type: 'list',
+                type: 'select',
                 name: 'memoryType',
                 message: 'Memory Type:',
                 choices: [
@@ -358,7 +358,7 @@ export class InteractiveMemoryCreator {
         // Confirm save
         const { action } = await inquirer.prompt([
             {
-                type: 'list',
+                type: 'select',
                 name: 'action',
                 message: 'Ready to save?',
                 choices: [
@@ -459,7 +459,7 @@ export class InteractiveSearch {
         // Result actions
         const { action } = await inquirer.prompt([
             {
-                type: 'list',
+                type: 'select',
                 name: 'action',
                 message: 'Actions:',
                 choices: [

package/dist/index.js

@@ -91,7 +91,14 @@ program
         actionCommand.parent?.name?.() === 'mcp-server';
     const isConfigFlow = actionCommand.name() === 'config' ||
         actionCommand.parent?.name?.() === 'config';
-    if (!forceDirectApi && !isMcpFlow && !isConfigFlow && !['init', 'auth', 'login', 'health', 'status'].includes(actionCommand.name())) {
+    // Memory, topic, org, and key commands use the direct REST API — skip MCP auto-connect
+    const isDirectApiFlow = actionCommand.name() === 'memory' ||
+        actionCommand.parent?.name?.() === 'memory' ||
+        actionCommand.name() === 'topic' ||
+        actionCommand.parent?.name?.() === 'topic' ||
+        actionCommand.name() === 'org' ||
+        actionCommand.parent?.name?.() === 'org';
+    if (!forceDirectApi && !isMcpFlow && !isConfigFlow && !isDirectApiFlow && !['init', 'auth', 'login', 'health', 'status'].includes(actionCommand.name())) {
         try {
             const client = getMCPClient();
             if (!client.isConnectedToServer()) {

package/dist/utils/api.d.ts

@@ -30,6 +30,7 @@ export interface MemoryEntry {
     memory_type: MemoryType;
     tags: string[];
     topic_id?: string | null;
+    topic_key?: string | null;
     user_id: string;
     organization_id: string;
     metadata?: Record<string, unknown>;
@@ -44,6 +45,7 @@ export interface CreateMemoryRequest {
     memory_type?: MemoryType;
     tags?: string[];
     topic_id?: string;
+    topic_key?: string;
     metadata?: Record<string, unknown>;
     continuity_key?: string;
     idempotency_key?: string;
@@ -55,6 +57,7 @@ export interface UpdateMemoryRequest {
     memory_type?: MemoryType;
     tags?: string[];
     topic_id?: string | null;
+    topic_key?: string;
     metadata?: Record<string, unknown>;
     continuity_key?: string;
     idempotency_key?: string;
@@ -67,6 +70,8 @@ export interface GetMemoriesParams {
     memory_type?: MemoryType;
     tags?: string[] | string;
     topic_id?: string;
+    topic_key?: string;
+    include_deleted?: boolean;
     user_id?: string;
     sort?: 'created_at' | 'updated_at' | 'last_accessed' | 'access_count' | 'title';
     order?: 'asc' | 'desc';
@@ -78,8 +83,11 @@ export interface SearchMemoryRequest {
     memory_types?: MemoryType[];
     tags?: string[];
     topic_id?: string;
+    topic_key?: string;
     limit?: number;
     threshold?: number;
+    include_deleted?: boolean;
+    response_mode?: 'full' | 'compact' | 'timeline';
 }
 export interface MemorySearchResult extends MemoryEntry {
     similarity_score: number;
@@ -180,6 +188,10 @@ export declare class APIClient {
     private normalizeMemoryEntry;
     private shouldUseLegacyMemoryRpcFallback;
     private shouldRetryViaApiGateway;
+    private shouldRetryViaSupabaseMemoryFunctions;
+    private shouldUsePostListFallback;
+    private getSupabaseFunctionsBaseUrl;
+    private mapMemoryApiRouteToSupabaseFunctions;
     private normalizeMcpPathToApi;
     constructor();
     login(email: string, password: string): Promise<AuthResponse>;

package/dist/utils/api.js

@@ -52,6 +52,135 @@ export class APIClient {
             return false;
         return code === 'ENOTFOUND' || code === 'EAI_AGAIN' || code === 'ECONNREFUSED';
     }
+    shouldRetryViaSupabaseMemoryFunctions(error) {
+        const status = Number(error?.response?.status || 0);
+        if (status !== 401 && status !== 404)
+            return false;
+        const cfg = (error?.config || {});
+        if (cfg.__retriedViaSupabaseMemoryFunctions || cfg.__useSupabaseMemoryFunctions)
+            return false;
+        const baseURL = String(cfg.baseURL || '');
+        if (baseURL.includes('supabase.co'))
+            return false;
+        const requestUrl = String(cfg.url || '');
+        const normalizedRequestUrl = requestUrl.startsWith('/memory')
+            ? this.normalizeMcpPathToApi(requestUrl)
+            : requestUrl;
+        if (!normalizedRequestUrl.startsWith('/api/v1/memories'))
+            return false;
+        const errorData = error?.response?.data;
+        const responseText = typeof errorData === 'string'
+            ? errorData
+            : `${errorData?.message || ''} ${errorData?.error || ''}`;
+        if (status === 401) {
+            const indicatesRouteShapeDrift = /invalid jwt|missing authorization header|authentication required|token is not active or has expired/i
+                .test(responseText);
+            if (!indicatesRouteShapeDrift)
+                return false;
+        }
+        if (status === 404) {
+            const isGetByIdRequest = /^\/api\/v1\/memories\/[^/?#]+$/.test(normalizedRequestUrl);
+            const indicatesMissingMcpGetRoute = /cannot get \/api\/v1\/memory\/|cannot get \/memory\/|route[_ -]?not[_ -]?found/i
+                .test(responseText.toLowerCase());
+            if (!isGetByIdRequest || !indicatesMissingMcpGetRoute)
+                return false;
+        }
+        const authMethod = String(this.config.get('authMethod') || '');
+        const token = this.config.getToken();
+        const hasOpaqueToken = Boolean(token) && token.split('.').length !== 3;
+        const hasVendorKey = this.config.hasVendorKey();
+        return hasVendorKey || hasOpaqueToken || authMethod === 'oauth' || authMethod === 'oauth2';
+    }
+    shouldUsePostListFallback(error) {
+        const status = Number(error?.response?.status || 0);
+        if (status === 405)
+            return true;
+        if (status !== 401)
+            return false;
+        const message = String(error?.response?.data?.message || error?.response?.data?.error || '');
+        return /missing authorization header|authentication required/i.test(message);
+    }
+    getSupabaseFunctionsBaseUrl() {
+        const discoveredServices = this.config.get('discoveredServices');
+        const candidates = [
+            process.env.LANONASIS_SUPABASE_URL,
+            process.env.SUPABASE_URL,
+            discoveredServices?.memory_base
+        ];
+        for (const candidate of candidates) {
+            if (typeof candidate === 'string'
+                && candidate.includes('supabase.co')
+                && !candidate.includes('your-project.supabase.co')
+                && !candidate.includes('<project-ref>.supabase.co')) {
+                return candidate.replace(/\/$/, '');
+            }
+        }
+        return 'https://lanonasis.supabase.co';
+    }
+    mapMemoryApiRouteToSupabaseFunctions(config, token, vendorKey) {
+        const method = String(config.method || 'get').toLowerCase();
+        const rawUrl = String(config.url || '');
+        const url = rawUrl.startsWith('/memory')
+            ? this.normalizeMcpPathToApi(rawUrl)
+            : rawUrl;
+        const mapped = config;
+        mapped.baseURL = this.getSupabaseFunctionsBaseUrl();
+        mapped.headers = mapped.headers || {};
+        if (token) {
+            mapped.headers.Authorization = `Bearer ${token}`;
+            delete mapped.headers['X-API-Key'];
+        }
+        else if (vendorKey) {
+            mapped.headers['X-API-Key'] = vendorKey;
+        }
+        // Supabase functions do not need X-Auth-Method and can reject unexpected values.
+        delete mapped.headers['X-Auth-Method'];
+        mapped.headers['X-Project-Scope'] = 'lanonasis-maas';
+        if (method === 'get' && url === '/api/v1/memories') {
+            mapped.url = '/functions/v1/memory-list';
+            return mapped;
+        }
+        if (method === 'post' && url === '/api/v1/memories') {
+            mapped.url = '/functions/v1/memory-create';
+            return mapped;
+        }
+        if (method === 'post' && url === '/api/v1/memories/search') {
+            mapped.url = '/functions/v1/memory-search';
+            return mapped;
+        }
+        if (method === 'get' && url === '/api/v1/memories/stats') {
+            mapped.url = '/functions/v1/memory-stats';
+            return mapped;
+        }
+        if (method === 'post' && url === '/api/v1/memories/bulk/delete') {
+            mapped.url = '/functions/v1/memory-bulk-delete';
+            return mapped;
+        }
+        const idMatch = url.match(/^\/api\/v1\/memories\/([^/?#]+)$/);
+        if (idMatch) {
+            const id = decodeURIComponent(idMatch[1] || '');
+            if (method === 'get') {
+                mapped.url = '/functions/v1/memory-get';
+                mapped.params = { ...(config.params || {}), id };
+                return mapped;
+            }
+            if (method === 'put' || method === 'patch') {
+                mapped.method = 'post';
+                mapped.url = '/functions/v1/memory-update';
+                const body = (config.data && typeof config.data === 'object')
+                    ? config.data
+                    : {};
+                mapped.data = { id, ...body };
+                return mapped;
+            }
+            if (method === 'delete') {
+                mapped.url = '/functions/v1/memory-delete';
+                mapped.params = { ...(config.params || {}), id };
+                return mapped;
+            }
+        }
+        return mapped;
+    }
     normalizeMcpPathToApi(url) {
         // MCP HTTP compatibility path -> API gateway REST paths
         if (url === '/memory') {
@@ -80,33 +209,50 @@ export class APIClient {
             const authMethod = this.config.get('authMethod');
             const vendorKey = await this.config.getVendorKeyAsync();
             const token = this.config.getToken();
-            const isMemoryEndpoint = typeof config.url === 'string' && config.url.startsWith('/api/v1/memories');
+            const useSupabaseMemoryFunctions = config.__useSupabaseMemoryFunctions === true;
+            const normalizedMemoryUrl = typeof config.url === 'string'
+                ? this.normalizeMcpPathToApi(config.url)
+                : '';
+            const isMemoryEndpoint = normalizedMemoryUrl.startsWith('/api/v1/memories');
             const forceApiFromEnv = process.env.LANONASIS_FORCE_API === 'true'
                 || process.env.CLI_FORCE_API === 'true'
                 || process.env.ONASIS_FORCE_API === 'true';
             const forceApiFromConfig = this.config.get('forceApi') === true
                 || this.config.get('connectionTransport') === 'api';
-            // Memory CRUD/search endpoints should always use the API gateway path.
+            if (useSupabaseMemoryFunctions && isMemoryEndpoint) {
+                const remapped = this.mapMemoryApiRouteToSupabaseFunctions(config, token || undefined, vendorKey || undefined);
+                if (process.env.CLI_VERBOSE === 'true') {
+                    const requestId = randomUUID();
+                    remapped.headers['X-Request-ID'] = requestId;
+                    remapped.headers['X-Transport-Mode'] = 'supabase-functions-fallback';
+                    console.log(chalk.dim(`→ ${String(remapped.method || 'get').toUpperCase()} ${remapped.url} [${requestId}]`));
+                    console.log(chalk.dim(`  transport=supabase-functions-fallback baseURL=${remapped.baseURL}`));
+                }
+                return remapped;
+            }
             const forceDirectApiRetry = config
                 .__forceDirectApiGatewayRetry === true;
-            const forceDirectApi = forceApiFromEnv || forceApiFromConfig || isMemoryEndpoint || forceDirectApiRetry;
+            // NOTE: isMemoryEndpoint is intentionally NOT in forceDirectApi.
+            // api.lanonasis.com is the vendor AI proxy, NOT the memory service.
+            // Memory operations must go to mcp.lanonasis.com.
+            const forceDirectApi = forceApiFromEnv || forceApiFromConfig || forceDirectApiRetry;
             const prefersTokenAuth = Boolean(token) && (authMethod === 'jwt' || authMethod === 'oauth' || authMethod === 'oauth2');
             const useVendorKeyAuth = Boolean(vendorKey) && !prefersTokenAuth;
             // Determine the correct API base URL:
             // - Auth endpoints -> auth.lanonasis.com
-            // - JWT auth (no vendor key) -> mcp.lanonasis.com (supports JWT tokens)
-            // - Vendor key auth -> api.lanonasis.com (requires vendor key)
+            // - Memory/MCP operations (JWT or vendor key) -> mcp.lanonasis.com (the memory service)
+            // - Other direct API calls -> api.lanonasis.com (vendor AI proxy)
             let apiBaseUrl;
-            const useMcpServer = !forceDirectApi && prefersTokenAuth && !useVendorKeyAuth;
+            const useMcpServer = !forceDirectApi && !isAuthEndpoint && (prefersTokenAuth || useVendorKeyAuth || isMemoryEndpoint);
             if (isAuthEndpoint) {
                 apiBaseUrl = discoveredServices?.auth_base || 'https://auth.lanonasis.com';
             }
             else if (forceDirectApi) {
-                // Force direct REST API mode to bypass MCP routing for troubleshooting.
+                // Explicit force: direct to api.lanonasis.com for troubleshooting.
                 apiBaseUrl = this.config.getApiUrl();
             }
             else if (useMcpServer) {
-                // JWT/OAuth tokens work with mcp.lanonasis.com
+                // Memory service lives at mcp.lanonasis.com — accepts JWT, OAuth, and vendor keys.
                 apiBaseUrl = 'https://mcp.lanonasis.com/api/v1';
             }
             else {
@@ -123,9 +269,7 @@ export class APIClient {
                 config.headers['X-Project-Scope'] = 'lanonasis-maas';
             }
             // Enhanced Authentication Support
-            // Even in forced direct-API mode, prefer bearer token auth when available.
-            // This avoids accidentally sending an OAuth access token as X-API-Key (we store it
-            // in secure storage for MCP/WebSocket usage), which can cause 401s.
+            // In forced direct-API mode, prefer bearer token auth when available.
             const preferVendorKeyInDirectApiMode = forceDirectApi && Boolean(vendorKey) && !prefersTokenAuth;
             if (preferVendorKeyInDirectApiMode) {
                 // Vendor key authentication (validated server-side)
@@ -169,6 +313,14 @@ export class APIClient {
             }
             return response;
         }, (error) => {
+            if (this.shouldRetryViaSupabaseMemoryFunctions(error)) {
+                const retryConfig = {
+                    ...error.config,
+                    __retriedViaSupabaseMemoryFunctions: true,
+                    __useSupabaseMemoryFunctions: true
+                };
+                return this.client.request(retryConfig);
+            }
             if (this.shouldRetryViaApiGateway(error)) {
                 const retryConfig = {
                     ...error.config,
@@ -247,7 +399,7 @@ export class APIClient {
         }
         catch (error) {
             // Backward-compatible fallback: newer API contracts may reject GET list.
-            if (error?.response?.status === 405) {
+            if (this.shouldUsePostListFallback(error)) {
                 const limit = Number(params.limit || 20);
                 const page = Number(params.page || 1);
                 const offset = Number(params.offset ?? Math.max(0, (page - 1) * limit));

package/dist/utils/config.d.ts

@@ -26,7 +26,7 @@ interface CLIConfigData {
     manualEndpointOverrides?: boolean;
     lastManualEndpointUpdate?: string;
     vendorKey?: string | undefined;
-    authMethod?: 'jwt' | 'vendor_key' | 'oauth' | undefined;
+    authMethod?: 'jwt' | 'vendor_key' | 'oauth' | 'oauth2' | undefined;
     tokenExpiry?: number | undefined;
     lastValidated?: string | undefined;
     deviceId?: string;
@@ -84,10 +84,14 @@ export declare class CLIConfig {
     setManualEndpoints(endpoints: Partial<CLIConfigData['discoveredServices']>): Promise<void>;
     hasManualEndpointOverrides(): boolean;
     /**
-     * Clears the in-memory auth cache and removes the `lastValidated` timestamp.
-     * Called after a definitive 401 from the memory API so that the next
-     * `isAuthenticated()` call performs a fresh server verification rather than
-     * returning a stale cached result.
+     * Clears the in-memory auth cache so that the next `isAuthenticated()` call
+     * performs a fresh server verification rather than returning a stale cached result.
+     *
+     * NOTE: `lastValidated` is intentionally NOT deleted here. Each auth path
+     * (vendor_key, token) already correctly rejects 401 responses without relying
+     * on `lastValidated`. Deleting it would destroy the offline grace period
+     * (7-day for vendor keys, 24-hour for JWT tokens), causing auth failures
+     * on transient network errors even when credentials are valid.
      */
     invalidateAuthCache(): Promise<void>;
     clearManualEndpointOverrides(): Promise<void>;
@@ -111,6 +115,7 @@ export declare class CLIConfig {
     setApiUrl(url: string): Promise<void>;
     setToken(token: string): Promise<void>;
     getToken(): string | undefined;
+    getAuthMethod(): string | undefined;
     getCurrentUser(): Promise<UserProfile | undefined>;
     isAuthenticated(): Promise<boolean>;
     logout(): Promise<void>;

package/dist/utils/config.js

@@ -670,15 +670,17 @@ export class CLIConfig {
         return !!this.config.manualEndpointOverrides;
     }
     /**
-     * Clears the in-memory auth cache and removes the `lastValidated` timestamp.
-     * Called after a definitive 401 from the memory API so that the next
-     * `isAuthenticated()` call performs a fresh server verification rather than
-     * returning a stale cached result.
+     * Clears the in-memory auth cache so that the next `isAuthenticated()` call
+     * performs a fresh server verification rather than returning a stale cached result.
+     *
+     * NOTE: `lastValidated` is intentionally NOT deleted here. Each auth path
+     * (vendor_key, token) already correctly rejects 401 responses without relying
+     * on `lastValidated`. Deleting it would destroy the offline grace period
+     * (7-day for vendor keys, 24-hour for JWT tokens), causing auth failures
+     * on transient network errors even when credentials are valid.
      */
     async invalidateAuthCache() {
         this.authCheckCache = null;
-        delete this.config.lastValidated;
-        await this.save().catch(() => { });
     }
     async clearManualEndpointOverrides() {
         delete this.config.manualEndpointOverrides;
@@ -894,6 +896,9 @@ export class CLIConfig {
     getToken() {
         return this.config.token;
     }
+    getAuthMethod() {
+        return this.config.authMethod;
+    }
     async getCurrentUser() {
         return this.config.user;
     }
@@ -962,15 +967,20 @@ export class CLIConfig {
         const token = this.getToken();
         if (!token)
             return false;
-        // OAuth tokens are often opaque (not JWT). Prefer local expiry metadata when present.
-        if (this.config.authMethod === 'oauth') {
+        // OAuth tokens are often opaque (not JWT). Use local expiry metadata as a quick
+        // pre-check, but do not treat it as authoritative for a "true" result. We still
+        // run server verification on cache misses to avoid status/API drift.
+        let oauthTokenLocallyValid;
+        if (this.config.authMethod === 'oauth' || this.config.authMethod === 'oauth2') {
             const tokenExpiresAt = this.get('token_expires_at');
             if (typeof tokenExpiresAt === 'number') {
-                const isValid = Date.now() < tokenExpiresAt;
-                this.authCheckCache = { isValid, timestamp: Date.now() };
-                return isValid;
+                oauthTokenLocallyValid = Date.now() < tokenExpiresAt;
+                if (!oauthTokenLocallyValid) {
+                    this.authCheckCache = { isValid: false, timestamp: Date.now() };
+                    return false;
+                }
             }
-            // Fall through to legacy validation when we don't have expiry metadata.
+            // Fall through to server validation path.
         }
         // Check cache first
         if (this.authCheckCache && (Date.now() - this.authCheckCache.timestamp) < this.AUTH_CACHE_TTL) {
@@ -978,9 +988,11 @@ export class CLIConfig {
         }
         // Local expiry check first (fast)
         let locallyValid = false;
-        // Handle simple CLI tokens (format: cli_xxx_timestamp)
-        if (token.startsWith('cli_')) {
-            // Extract timestamp from CLI token
+        if (typeof oauthTokenLocallyValid === 'boolean') {
+            locallyValid = oauthTokenLocallyValid;
+        }
+        else if (token.startsWith('cli_')) {
+            // Handle simple CLI tokens (format: cli_xxx_timestamp)
             const parts = token.split('_');
             if (parts.length >= 3) {
                 const lastPart = parts[parts.length - 1];
@@ -1033,17 +1045,7 @@ export class CLIConfig {
             this.authCheckCache = { isValid: false, timestamp: Date.now() };
             return false;
         }
-        // Token is locally valid - check if we need server validation
-        // Skip server validation if we have a recent lastValidated timestamp (within 24 hours)
-        const lastValidated = this.config.lastValidated;
-        const skipServerValidation = lastValidated &&
-            (Date.now() - new Date(lastValidated).getTime()) < (24 * 60 * 60 * 1000); // 24 hours
-        if (skipServerValidation) {
-            // Trust the local validation if it was recently validated
-            this.authCheckCache = { isValid: locallyValid, timestamp: Date.now() };
-            return locallyValid;
-        }
-        // Verify with server (security check) for tokens that haven't been validated recently
+        // Token is locally valid - verify with server on cache miss for consistency
         try {
             // Try auth-gateway first (port 4000), then fall back to Netlify function
             const endpoints = [
@@ -1059,16 +1061,25 @@ export class CLIConfig {
                     if (response.data.valid === true) {
                         break;
                     }
-                    // Server explicitly said invalid - this is an auth error, not network error
+                    // Explicit auth rejection should always invalidate local auth state.
                     if (response.status === 401 || response.status === 403 || response.data.valid === false) {
                         authError = true;
                     }
+                    else {
+                        // Non-auth failures (like 404/5xx) should behave like transient verification failures.
+                        networkError = true;
+                    }
                 }
                 catch (error) {
-                    // Check if this is a network error (no response) vs auth error (got response)
+                    // Check if this is a network/transient error vs explicit auth rejection.
                     if (error.response) {
-                        // Got a response, likely 401/403
-                        authError = true;
+                        const status = error.response.status;
+                        if (status === 401 || status === 403) {
+                            authError = true;
+                        }
+                        else {
+                            networkError = true;
+                        }
                     }
                     else {
                         // Network error (ECONNREFUSED, ETIMEDOUT, etc.)
@@ -1196,6 +1207,12 @@ export class CLIConfig {
             return;
         }
         try {
+            // Vendor-key sessions should never attempt token refresh.
+            // Some environments retain stale token/refresh_token fields from older logins,
+            // which can otherwise trip dead refresh routes during normal memory commands.
+            if (String(this.config.authMethod || '').toLowerCase() === 'vendor_key') {
+                return;
+            }
             // OAuth token refresh (opaque tokens + refresh_token + token_expires_at)
             if (this.config.authMethod === 'oauth') {
                 const refreshToken = this.get('refresh_token');
@@ -1376,8 +1393,25 @@ export class CLIConfig {
             'wss://mcp.lanonasis.com/ws';
     }
     getMCPRestUrl() {
-        return this.config.discoveredServices?.mcp_base ||
-            'https://mcp.lanonasis.com/api/v1';
+        const configured = this.config.mcpServerUrl;
+        if (typeof configured === 'string' && configured.trim().length > 0) {
+            return configured.trim();
+        }
+        const discoveredMcpBase = this.config.discoveredServices?.mcp_base;
+        if (typeof discoveredMcpBase === 'string' && discoveredMcpBase.trim().length > 0) {
+            const normalizedMcpBase = discoveredMcpBase.trim().replace(/\/$/, '');
+            const normalizedMemoryBase = (this.config.discoveredServices?.memory_base || '')
+                .toString()
+                .trim()
+                .replace(/\/$/, '');
+            // Guard against service-discovery payloads that map MCP REST to the memory API host.
+            const pointsToMemoryBase = normalizedMemoryBase.length > 0 &&
+                normalizedMcpBase.replace(/\/api\/v1$/, '') === normalizedMemoryBase;
+            if (!pointsToMemoryBase) {
+                return normalizedMcpBase;
+            }
+        }
+        return 'https://mcp.lanonasis.com/api/v1';
     }
     getMCPSSEUrl() {
         return this.config.discoveredServices?.mcp_sse_base ||

package/dist/utils/mcp-client.d.ts

@@ -112,6 +112,8 @@ export declare class MCPClient {
      * Calculate exponential backoff delay with jitter
      */
     private exponentialBackoff;
+    private resolveAuthCredential;
+    private buildAuthHeaders;
     /**
      * Validate authentication credentials before attempting MCP connection
      */

package/dist/utils/mcp-client.js

@@ -356,31 +356,69 @@ export class MCPClient {
         const jitter = cappedDelay * 0.25 * (Math.random() - 0.5);
         return Math.round(cappedDelay + jitter);
     }
+    async resolveAuthCredential() {
+        const authMethod = String(this.config.get('authMethod') || '').toLowerCase();
+        const token = this.config.get('token');
+        const vendorKey = await this.config.getVendorKeyAsync();
+        if (authMethod === 'vendor_key' && typeof vendorKey === 'string' && vendorKey.trim().length > 0) {
+            return { value: vendorKey.trim(), source: 'vendor_key' };
+        }
+        if ((authMethod === 'oauth' || authMethod === 'oauth2' || authMethod === 'jwt') &&
+            typeof token === 'string' &&
+            token.trim().length > 0) {
+            return { value: token.trim(), source: 'token' };
+        }
+        if (typeof token === 'string' && token.trim().length > 0) {
+            return { value: token.trim(), source: 'token' };
+        }
+        if (typeof vendorKey === 'string' && vendorKey.trim().length > 0) {
+            return { value: vendorKey.trim(), source: 'vendor_key' };
+        }
+        const envKey = process.env.LANONASIS_API_KEY;
+        if (typeof envKey === 'string' && envKey.trim().length > 0) {
+            return { value: envKey.trim(), source: 'env' };
+        }
+        return null;
+    }
+    buildAuthHeaders(auth) {
+        const headers = {};
+        const value = auth.value.trim();
+        if (!value) {
+            return headers;
+        }
+        if (auth.source === 'vendor_key' || value.startsWith('lano_') || value.startsWith('lms_')) {
+            headers['X-API-Key'] = value;
+            headers['X-Auth-Method'] = 'vendor_key';
+            headers['X-Project-Scope'] = 'lanonasis-maas';
+            return headers;
+        }
+        if (value.toLowerCase().startsWith('bearer ')) {
+            headers['Authorization'] = value;
+            headers['X-Auth-Method'] = 'jwt';
+            headers['X-Project-Scope'] = 'lanonasis-maas';
+            return headers;
+        }
+        headers['Authorization'] = `Bearer ${value}`;
+        headers['X-Auth-Method'] = 'jwt';
+        headers['X-Project-Scope'] = 'lanonasis-maas';
+        return headers;
+    }
     /**
      * Validate authentication credentials before attempting MCP connection
      */
     async validateAuthBeforeConnect() {
-        const token = this.config.get('token');
-        const vendorKey = await this.config.getVendorKeyAsync();
-        // Check if we have any authentication credentials
-        if (!token && !vendorKey) {
+        const auth = await this.resolveAuthCredential();
+        if (!auth) {
             throw new Error('AUTHENTICATION_REQUIRED: No authentication credentials found. Run "lanonasis auth login" first.');
         }
-        // If we have a token, check if it's expired or needs refresh
-        if (token) {
-            try {
-                await this.validateAndRefreshToken(token);
-            }
-            catch (error) {
-                throw new Error(`AUTHENTICATION_INVALID: ${error instanceof Error ? error.message : 'Token validation failed'}`);
-            }
-        }
-        // If we have a vendor key, ensure it is valid (non-empty)
-        if (vendorKey && !token) {
-            const validationResult = this.config.validateVendorKeyFormat(vendorKey);
-            if (validationResult !== true) {
-                throw new Error(`AUTHENTICATION_INVALID: ${typeof validationResult === 'string' ? validationResult : 'Vendor key is invalid'}`);
+        await this.config.refreshTokenIfNeeded();
+        const verification = await this.config.verifyCurrentCredentialsWithServer();
+        if (!verification.valid) {
+            const reason = verification.reason || 'Credential verification failed';
+            if (verification.method === 'none') {
+                throw new Error(`AUTHENTICATION_REQUIRED: ${reason}`);
             }
+            throw new Error(`AUTHENTICATION_INVALID: ${reason}`);
         }
     }
     /**
@@ -460,12 +498,10 @@ export class MCPClient {
     async initializeSSE(serverUrl) {
         // Use the proper SSE endpoint from config
         const sseUrl = this.config.getMCPSSEUrl() ?? `${serverUrl}/events`;
-        const token = this.config.get('token');
-        const vendorKey = await this.config.getVendorKeyAsync();
-        const authKey = token || vendorKey || process.env.LANONASIS_API_KEY;
-        if (authKey) {
+        const auth = await this.resolveAuthCredential();
+        if (auth) {
             // EventSource doesn't support headers directly, append token to URL
-            this.sseConnection = new EventSource(`${sseUrl}?token=${encodeURIComponent(authKey)}`);
+            this.sseConnection = new EventSource(`${sseUrl}?token=${encodeURIComponent(auth.value)}`);
             this.sseConnection.onmessage = (event) => {
                 try {
                     const data = JSON.parse(event.data);
@@ -479,7 +515,11 @@ export class MCPClient {
                 }
             };
             this.sseConnection.onerror = () => {
-                console.error(chalk.yellow('⚠️  SSE connection error (will retry)'));
+                if (process.env.CLI_VERBOSE === 'true') {
+                    console.error(chalk.yellow('⚠️  SSE connection error (stream disabled for this session)'));
+                }
+                this.sseConnection?.close();
+                this.sseConnection = null;
             };
         }
     }
@@ -487,12 +527,11 @@ export class MCPClient {
      * Initialize WebSocket connection for enterprise MCP server
      */
     async initializeWebSocket(wsUrl) {
-        const token = this.config.get('token');
-        const vendorKey = await this.config.getVendorKeyAsync();
-        const authKey = token || vendorKey || process.env.LANONASIS_API_KEY;
-        if (!authKey) {
+        const auth = await this.resolveAuthCredential();
+        if (!auth) {
             throw new Error('API key required for WebSocket mode. Set LANONASIS_API_KEY or login first.');
         }
+        const wsHeaders = this.buildAuthHeaders(auth);
         return new Promise((resolve, reject) => {
             try {
                 // Close existing connection if any
@@ -502,10 +541,7 @@ export class MCPClient {
                 }
                 // Create new WebSocket connection with authentication
                 this.wsConnection = new WebSocket(wsUrl, [], {
-                    headers: {
-                        'Authorization': `Bearer ${authKey}`,
-                        'X-API-Key': authKey
-                    }
+                    headers: wsHeaders
                 });
                 this.wsConnection.on('open', () => {
                     console.log(chalk.green('✅ Connected to MCP WebSocket server'));
@@ -653,19 +689,14 @@ export class MCPClient {
      */
     async checkRemoteHealth(serverUrl) {
         const apiUrl = serverUrl ?? this.config.getMCPRestUrl() ?? 'https://mcp.lanonasis.com/api/v1';
-        const token = this.config.get('token');
-        const vendorKey = await this.config.getVendorKeyAsync();
-        const authKey = token || vendorKey || process.env.LANONASIS_API_KEY;
-        if (!authKey) {
+        const auth = await this.resolveAuthCredential();
+        if (!auth) {
             throw new Error('No authentication token available');
         }
         try {
             const axios = (await import('axios')).default;
             await axios.get(`${apiUrl}/health`, {
-                headers: {
-                    'Authorization': `Bearer ${authKey}`,
-                    'X-API-Key': authKey
-                },
+                headers: this.buildAuthHeaders(auth),
                 timeout: 5000
             });
         }
@@ -786,10 +817,8 @@ export class MCPClient {
      */
     async callRemoteTool(toolName, args) {
         const apiUrl = this.config.getMCPRestUrl() ?? 'https://mcp.lanonasis.com/api/v1';
-        const token = this.config.get('token');
-        const vendorKey = await this.config.getVendorKeyAsync();
-        const authKey = token || vendorKey || process.env.LANONASIS_API_KEY;
-        if (!authKey) {
+        const auth = await this.resolveAuthCredential();
+        if (!auth) {
             throw new Error('Authentication required. Run "lanonasis auth login" first.');
         }
         // Map MCP tool names to REST API endpoints
@@ -845,8 +874,7 @@ export class MCPClient {
                 method: mapping.method,
                 url: `${apiUrl}${endpoint}`,
                 headers: {
-                    'Authorization': `Bearer ${authKey}`,
-                    'X-API-Key': authKey,
+                    ...this.buildAuthHeaders(auth),
                     'Content-Type': 'application/json'
                 },
                 data: mapping.transform ? mapping.transform(args) : undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.8",
+  "version": "3.9.9",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",
@@ -86,7 +86,7 @@
     "typescript": "^5.9.3"
   },
   "scripts": {
-    "build": "rimraf dist && tsc -p tsconfig.json",
+    "build": "rimraf dist && tsc -p tsconfig.json && chmod +x dist/index.js dist/mcp-server-entry.js 2>/dev/null || true",
     "prepublishOnly": "npm run build",
     "postinstall": "node scripts/postinstall.js",
     "test": "[ -f node_modules/jest/bin/jest.js ] || bun install --no-save; node --experimental-vm-modules node_modules/jest/bin/jest.js",