apple-notes-mcp 2.5.2 → 2.5.4

package/README.md

@@ -6,6 +6,7 @@ A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that e
 [![npm downloads](https://img.shields.io/npm/dm/apple-notes-mcp)](https://www.npmjs.com/package/apple-notes-mcp)
 [![node](https://img.shields.io/node/v/apple-notes-mcp)](https://www.npmjs.com/package/apple-notes-mcp)
 [![CI](https://github.com/sweetrb/apple-notes-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/sweetrb/apple-notes-mcp/actions/workflows/ci.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sweetrb/apple-notes-mcp/badge)](https://scorecard.dev/viewer/?uri=github.com/sweetrb/apple-notes-mcp)
 [![platform: macOS](https://img.shields.io/badge/platform-macOS-111?logo=apple&logoColor=white)](https://www.apple.com/macos/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![MCP](https://img.shields.io/badge/MCP-server-blue)](https://modelcontextprotocol.io)

package/build/index.js

@@ -1303,5 +1303,16 @@ server.registerTool("get-note-metadata", {
  */
 // Register read-only resources and workflow prompts (#23).
 registerResourcesAndPrompts(server, notesManager);
+// Defense-in-depth: an unhandled rejection or a stray EventEmitter "error" must
+// never take down this long-lived MCP server. EPIPE on stdout means the MCP
+// client disconnected — exit cleanly rather than crash.
+process.on("uncaughtException", (err) => {
+    if (err?.code === "EPIPE")
+        process.exit(0);
+    console.error("[uncaughtException]", err);
+});
+process.on("unhandledRejection", (reason) => {
+    console.error("[unhandledRejection]", reason);
+});
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/build/services/appleNotesManager.js

@@ -2436,11 +2436,21 @@ export class AppleNotesManager {
      * Simple HTML to plaintext conversion for export.
      */
     htmlToPlaintext(html) {
-        return (html
+        // Convert block/line breaks to newlines first.
+        let text = html
             .replace(/<br\s*\/?>/gi, "\n")
             .replace(/<\/div>/gi, "\n")
-            .replace(/<\/p>/gi, "\n")
-            .replace(/<[^>]+>/g, "")
+            .replace(/<\/p>/gi, "\n");
+        // Strip any remaining tags, looping until the string stabilizes. A single
+        // pass can leave residue when removing one tag re-forms another (e.g.
+        // "<<i>>"), so we repeat until there are no more matches — the recognized
+        // fix for CodeQL js/incomplete-multi-character-sanitization.
+        let prev;
+        do {
+            prev = text;
+            text = text.replace(/<[^>]*>/g, "");
+        } while (text !== prev);
+        return (text
             .replace(/&nbsp;/g, " ")
             .replace(/&lt;/g, "<")
             .replace(/&gt;/g, ">")

package/build/services/appleNotesManager.test.js

@@ -2402,4 +2402,11 @@ describe("htmlToPlaintext (export helper)", () => {
         expect(toPlaintext("a<br><br><br><br>b")).toBe("a\n\nb");
         expect(toPlaintext("  <div>x</div>  ")).toBe("x");
     });
+    it("strips nested/overlapping tags without leaving a tag (iterated strip)", () => {
+        // A single pass can leave residue when removing one tag re-forms another;
+        // the loop keeps stripping until no <...> remains.
+        expect(toPlaintext("a<<i>>b")).not.toMatch(/<[^>]*>/);
+        expect(toPlaintext("<x<y>z>")).not.toMatch(/<[^>]*>/);
+        expect(toPlaintext("plain <b>text</b> here")).toBe("plain text here");
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-notes-mcp",
-  "version": "2.5.2",
+  "version": "2.5.4",
   "description": "MCP server for Apple Notes - create, search, update, and manage notes via Claude and other AI assistants",
   "type": "module",
   "main": "build/index.js",