apple-notes-mcp 1.4.3 → 1.4.4

package/build/services/appleNotesManager.js

@@ -97,6 +97,22 @@ export function escapeHtmlForAppleScript(htmlContent) {
     // We do NOT re-encode HTML entities since content is already HTML from Notes.app
     return htmlContent.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
+/**
+ * Escapes a plain (non-HTML) string for safe embedding in an AppleScript string literal.
+ *
+ * Use this for folder names, account names, and other metadata that Apple Notes
+ * stores as plain text — NOT for note body content (use escapeForAppleScript instead).
+ * HTML-encoding ampersands here would produce `folder "R&D"`, which Apple Notes
+ * would fail to match against the real folder named "R&D".
+ *
+ * @param text - Plain string (folder name, account name, etc.)
+ * @returns String safe for AppleScript string embedding
+ */
+export function escapePlainStringForAppleScript(text) {
+    if (!text)
+        return "";
+    return text.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
 // =============================================================================
 // Input Validation & Sanitization
 // =============================================================================
@@ -154,7 +170,7 @@ export function sanitizeId(id) {
  */
 function sanitizeAccountName(account) {
     validateLength(account, MAX_ACCOUNT_LENGTH, "Account name");
-    return escapeForAppleScript(account);
+    return escapePlainStringForAppleScript(account);
 }
 /**
  * Counter for generating unique fallback IDs within the same millisecond.
@@ -325,7 +341,7 @@ export function buildFolderReference(folderPath) {
     // Build inside-out: last part is innermost, first part is outermost
     return parts
         .reverse()
-        .map((part) => `folder "${escapeForAppleScript(part)}"`)
+        .map((part) => `folder "${escapePlainStringForAppleScript(part)}"`)
         .join(" of ");
 }
 /**

package/build/services/appleNotesManager.test.js

@@ -242,7 +242,7 @@ describe("buildFolderReference", () => {
     it("handles special characters in folder names", () => {
         const result = buildFolderReference("Food & Drink/🥘 Recipes");
         expect(result).toContain('folder "🥘 Recipes"');
-        expect(result).toContain('folder "Food & Drink"');
+        expect(result).toContain('folder "Food & Drink"');
     });
     it("handles escaped slashes in folder names", () => {
         const result = buildFolderReference("Travel/Spain\\/Portugal 2023");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-notes-mcp",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "description": "MCP server for Apple Notes - create, search, update, and manage notes via Claude",
   "type": "module",
   "main": "build/index.js",