@@ -51,6 +51,9 @@ a different one. Standalone installations keep their own default. Use
 `--workspace-source app|terminal` or `ZENNOTES_WORKSPACE_SOURCE` to select the source
 explicitly; `--vault` and `--server` still select a specific destination. The TUI
 uses its own saved selection unless `--workspace-source app` is explicitly passed.
+When the desktop app is on a ZenNotes server, desktop-managed commands and `zn mcp`
+authenticate with the token `zn connect` saved for that server's URL: the app keeps
+its own copy in the OS secret store, which zn cannot read.
 
 If an older desktop build reports **Unknown command** for `zn tui`, check
 `type -a zn`. A Homebrew installation can be run directly with
@@ -342,6 +345,20 @@ message naming the old and the new vault until the assistant calls
 `vault_info`, which confirms the switch, and the calls after it run in the
 new vault. Nothing an assistant planned in one vault lands in the other.
 
+A vault on a ZenNotes server that needs a token gets it the way every
+command does: `--token`, then `ZENNOTES_REMOTE_TOKEN`, then the token
+`zn connect` saved for the server's URL. The desktop app keeps its copy in
+the OS secret store, which zn cannot read, so run this once and the MCP
+server authenticates whenever the app is connected to that server, with no
+token in any client config:
+
+```bash
+zn connect https://notes.example.com --no-default
+```
+
+`--no-default` saves the token without making the server zn's own default,
+so zn keeps following the app.
+
 ## Demo recordings
 
 `docs/demo/` holds the seeded vaults and the keystroke choreography;
 
@@ -10,6 +10,12 @@ Desktop-managed commands set `ZENNOTES_WORKSPACE_SOURCE=app`. They use desktop
 vault/profile names, credentials and current selection. A terminal workspace with
 the same name cannot redirect an existing desktop script or MCP client.
 
+The desktop keeps server tokens in the OS secret store, which zn cannot read. When
+neither `--token`, `ZENNOTES_REMOTE_TOKEN` nor the desktop profile supplies one, app
+mode uses the token `zn connect` saved for the same server URL. The lookup is keyed
+by the URL the desktop selected, so it authenticates that server and never selects
+a different one.
+
 `zn tui` defaults to the separately saved terminal workspace. Explicit selectors
 and `--workspace-source app|terminal` take precedence. MCP resolves the workspace
 again before every tool call and follows a desktop switch once `vault_info`
 
@@ -76,7 +76,9 @@ func TestDesktopWorkspaceSourceKeepsDesktopTokenPrecedence(t *testing.T) {
 		{"app default", "", "", "app", "app-token"},
 		{"app server", "", "home", "app", "app-token"},
 		{"app vault", "home", "", "app", "app-token"},
-		{"app URL", "", baseURL, "app", ""},
+		// No desktop token comes with a bare URL, so the one `zn connect`
+		// saved for it is the fallback.
+		{"app URL", "", baseURL, "app", "terminal-token"},
 		{"terminal default", "", "", "terminal", "terminal-token"},
 		{"terminal server", "", "home", "terminal", "terminal-token"},
 		{"terminal URL", "", baseURL, "terminal", "terminal-token"},
@@ -98,3 +100,65 @@ func TestDesktopWorkspaceSourceKeepsDesktopTokenPrecedence(t *testing.T) {
 		})
 	}
 }
+
+// The app keeps its server tokens in the OS secret store, so a current
+// desktop config carries none. App mode then falls back to the token
+// `zn connect` saved for the server the app has open, and to nothing else.
+func TestDesktopWorkspaceSourceFallsBackToTheZnConnectToken(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("ZENNOTES_CONFIG_DIR", dir)
+	t.Setenv("ZENNOTES_VAULT", "")
+	t.Setenv("ZENNOTES_SERVER", "")
+	t.Setenv(RemoteTokenEnv, "")
+	data, _ := json.Marshal(map[string]any{
+		"workspaceMode": "remote", "remoteWorkspace": map[string]string{"baseUrl": "https://notes.example.com/"},
+		"remoteWorkspaceProfileId": "p1",
+		"remoteWorkspaceProfiles":  []map[string]string{{"id": "p1", "name": "home", "baseUrl": "https://Notes.Example.com"}},
+	})
+	if err := os.WriteFile(filepath.Join(dir, config.AppConfigFile), data, 0600); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct{ name, vault, server, want string }{
+		{"default", "", "", ""},
+		{"server", "", "home", ""},
+		{"vault", "home", "", ""},
+	} {
+		if got, err := ResolveTargetWithSource(tc.vault, tc.server, "", "app"); err != nil || got.AuthToken != tc.want {
+			t.Fatalf("%s before zn connect: token %q, error %v", tc.name, got.AuthToken, err)
+		}
+	}
+	if err := config.SaveToken("https://notes.example.com", "zn-token"); err != nil {
+		t.Fatal(err)
+	}
+	if err := config.SaveToken("https://other.example.com", "other-token"); err != nil {
+		t.Fatal(err)
+	}
+	// A terminal default elsewhere must not redirect the app's workspace.
+	ws := config.LoadWorkspaces()
+	ws.AddServer("other", "https://other.example.com")
+	ws.Default = "other"
+	if err := config.SaveWorkspaces(ws); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct{ name, vault, server, wantURL, want string }{
+		{"default", "", "", "https://notes.example.com", "zn-token"},
+		{"server", "", "home", "https://Notes.Example.com", "zn-token"},
+		{"vault", "home", "", "https://Notes.Example.com", "zn-token"},
+		{"other URL", "", "https://other.example.com", "https://other.example.com", "other-token"},
+		{"unsaved URL", "", "https://third.example.com", "https://third.example.com", ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := ResolveTargetWithSource(tc.vault, tc.server, "", "app")
+			if err != nil || got.Kind != KindRemote || got.BaseURL != tc.wantURL || got.AuthToken != tc.want {
+				t.Fatalf("got %s token %q, error %v; want %s token %q", got.Label(), got.AuthToken, err, tc.wantURL, tc.want)
+			}
+			t.Setenv(RemoteTokenEnv, "env-token")
+			if got, _ := ResolveTargetWithSource(tc.vault, tc.server, "", "app"); got.AuthToken != "env-token" {
+				t.Fatalf("environment token did not win: %q", got.AuthToken)
+			}
+			if got, _ := ResolveTargetWithSource(tc.vault, tc.server, "flag-token", "app"); got.AuthToken != "flag-token" {
+				t.Fatalf("flag token did not win: %q", got.AuthToken)
+			}
+		})
+	}
+}
@@ -62,13 +62,26 @@ func ResolveAuthTokenFor(baseURL, flagToken, profileToken string) string {
 	return strings.TrimSpace(profileToken)
 }
 
-// ResolveAuthTokenForSource preserves the desktop CLI's token precedence in
-// app mode; terminal mode may additionally use credentials saved by zn connect.
+// ResolveAuthTokenForSource is the token for a server the given source
+// picked. Both sources take `--token`, then the environment. Terminal mode
+// then prefers the token `zn connect` saved for the URL over the desktop
+// profile's. App mode keeps the desktop profile's token first and falls back
+// to the saved one, because the app keeps its own copy in the OS secret
+// store, where zn cannot read it: without the fallback, a desktop-managed zn
+// and its `zn mcp` cannot reach the server the app is connected to at all.
+// The saved token is looked up by the URL the app chose, so it can only
+// authenticate that server, never pick a different one.
 func ResolveAuthTokenForSource(baseURL, flagToken, profileToken, source string) string {
-	if source == "app" {
-		return ResolveAuthToken(flagToken, profileToken)
+	if source != "app" {
+		return ResolveAuthTokenFor(baseURL, flagToken, profileToken)
 	}
-	return ResolveAuthTokenFor(baseURL, flagToken, profileToken)
+	if token := ResolveAuthToken(flagToken, profileToken); token != "" {
+		return token
+	}
+	if baseURL == "" {
+		return ""
+	}
+	return config.LoadToken(baseURL)
 }
 
 // Label names a target the way Backend.Label names an open one: the
 
@@ -122,6 +122,16 @@ func cmdConnect(ctx context.Context, args Args) error {
 		return nil
 	}
 	emitOK(fmt.Sprintf("Connected to %s (%s)", entry.Name, baseURL))
+	if source, _ := backend.ResolveWorkspaceSource(args.Str("workspace-source")); source == "app" {
+		// A desktop-managed zn follows the app whatever zn's default says, so
+		// "zn uses it by default now" would be wrong here: only zn tui does.
+		if makeDefault {
+			emitLine("zn tui opens it by default now. Other zn commands and zn mcp keep following the ZenNotes app, and use this token whenever the app is connected to " + baseURL + ".")
+		} else {
+			emitLine("zn commands and zn mcp use this token whenever the ZenNotes app is connected to " + baseURL + "; `--server " + baseURL + "` reaches it directly.")
+		}
+		return nil
+	}
 	if makeDefault {
 		emitLine("zn and zn tui use it by default now. `zn use <name>` switches, `zn disconnect " + entry.Name + "` forgets it.")
 	} else {
 
@@ -101,3 +101,56 @@ func TestConnectInitUseAndList(t *testing.T) {
 		t.Fatal("disconnect forgets the server and its token")
 	}
 }
+
+// A desktop-managed zn follows the app, so `zn connect` must not claim zn
+// now uses the server by default; what it does is give zn (and zn mcp) the
+// token for the server whenever the app has it open.
+func TestConnectUnderTheDesktopLauncherAuthenticatesTheAppsServer(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("ZENNOTES_CONFIG_DIR", dir)
+	t.Setenv("ZENNOTES_VAULT", "")
+	t.Setenv("ZENNOTES_SERVER", "")
+	t.Setenv("ZENNOTES_REMOTE_TOKEN", "")
+	t.Setenv("ZENNOTES_WORKSPACE_SOURCE", "app")
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "Bearer right" {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/api/vault":
+			_, _ = w.Write([]byte(`{"root":"/srv/notes","name":"notes"}`))
+		case "/api/notes":
+			_, _ = w.Write([]byte(`[]`))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	defer server.Close()
+	app := `{"workspaceMode":"remote","remoteWorkspace":{"baseUrl":"` + server.URL + `"},"remoteWorkspaceProfiles":[{"name":"home","baseUrl":"` + server.URL + `"}]}`
+	if err := os.WriteFile(filepath.Join(dir, config.AppConfigFile), []byte(app), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	out := captureOutput(t, func() { _ = Main([]string{"list", "--json"}) })
+	if !strings.Contains(out, "zn:") {
+		t.Fatalf("without a token the app's server must refuse: %s", out)
+	}
+	out = captureOutput(t, func() {
+		if code := Main([]string{"connect", server.URL, "--token", "right"}); code != 0 {
+			t.Errorf("connect failed")
+		}
+	})
+	if !strings.Contains(out, "zn tui opens it by default now") || !strings.Contains(out, "keep following the ZenNotes app") || strings.Contains(out, "zn and zn tui use it") {
+		t.Fatalf("connect output under the desktop launcher: %s", out)
+	}
+	out = captureOutput(t, func() { _ = Main([]string{"list", "--json"}) })
+	if strings.Contains(out, "zn:") {
+		t.Fatalf("the saved token must reach the app's server: %s", out)
+	}
+	out = captureOutput(t, func() { _ = Main([]string{"connect", server.URL, "--token", "right", "--no-default"}) })
+	if !strings.Contains(out, "zn commands and zn mcp use this token whenever the ZenNotes app is connected to "+server.URL) {
+		t.Fatalf("--no-default output under the desktop launcher: %s", out)
+	}
+}
@@ -3,6 +3,8 @@ package mcp
 import (
 	"context"
 	"encoding/json"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
@@ -122,3 +124,34 @@ func TestRunFollowsAVaultSwitchOnlyAfterVaultInfo(t *testing.T) {
 		t.Fatalf("the switch note repeats: %s", text)
 	}
 }
+
+func TestRunNamesTheZnConnectCommandOnA401(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnauthorized)
+	}))
+	defer server.Close()
+	cs := runServer(t, func() (backend.Target, error) {
+		return backend.Target{Kind: backend.KindRemote, BaseURL: server.URL}, nil
+	})
+	text, isErr := callTool(t, cs, "list_notes", nil)
+	if !isErr || !strings.Contains(text, "zn connect "+server.URL+" --no-default") || !strings.Contains(text, "ZENNOTES_REMOTE_TOKEN") {
+		t.Fatalf("401 hint: %s", text)
+	}
+}
+
+// A stale ZENNOTES_REMOTE_TOKEN outranks any token `zn connect` saves, so
+// the hint has to name it rather than send the user to zn connect again.
+func TestRunBlamesAStaleEnvironmentTokenOnA401(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnauthorized)
+	}))
+	defer server.Close()
+	t.Setenv(backend.RemoteTokenEnv, "stale")
+	cs := runServer(t, func() (backend.Target, error) {
+		return backend.Target{Kind: backend.KindRemote, BaseURL: server.URL, AuthToken: "stale"}, nil
+	})
+	text, isErr := callTool(t, cs, "list_notes", nil)
+	if !isErr || !strings.Contains(text, "The rejected token is ZENNOTES_REMOTE_TOKEN") || !strings.Contains(text, "zn connect "+server.URL+" --no-default") {
+		t.Fatalf("stale environment token hint: %s", text)
+	}
+}
@@ -11,6 +11,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
 	"sort"
 	"strings"
 
@@ -171,7 +172,7 @@ func tools() []toolDef {
 				if description.Kind == backend.KindRemote {
 					notes := "This vault lives on a self-hosted ZenNotes server, the workspace the desktop app currently has open. Every tool works on it through the server API; paths are vault-relative POSIX paths exactly as the server reports them. " + pathNotes
 					if !description.AuthConfigured {
-						notes += " No token is configured for this server in this process. If calls fail with 401, set ZENNOTES_REMOTE_TOKEN in the MCP server's environment to the token the server was started with."
+						notes += " No token is configured for this server in this process. If calls fail with 401, " + tokenHint(description.BaseURL)
 					}
 					var serverName, vaultPath, vaultName *string
 					if description.Name != "" {
@@ -998,16 +999,36 @@ func CallTool(ctx context.Context, name string, a map[string]any, b Backend) (an
 
 // DescribeToolError phrases a failure for the agent. A server that turns
 // the request away is the one failure an agent cannot fix by retrying: the
-// desktop app keeps its token in the OS secret store, so this process only
-// has one if the environment supplied it.
-func DescribeToolError(err error) string {
+// desktop app keeps its token in the OS secret store, where zn cannot read
+// it, so say how to give this process one. b is the backend the call ran
+// against, nil when none resolved.
+func DescribeToolError(err error, b Backend) string {
 	msg := err.Error()
 	if status := remote.StatusOf(err); status == 401 || status == 403 {
-		return msg + " The MCP server has no valid token for this ZenNotes server. Set ZENNOTES_REMOTE_TOKEN in the MCP server's environment (the desktop app's copy lives in the OS secret store, which zn cannot read), or run zn with --token."
+		serverURL := ""
+		if r, ok := b.(*backend.Remote); ok {
+			serverURL = r.Client().BaseURL
+			// The environment outranks a saved token, so a stale one there
+			// keeps failing however often `zn connect` runs.
+			if fromEnv := strings.TrimSpace(os.Getenv(backend.RemoteTokenEnv)); fromEnv != "" && r.Client().AuthToken == fromEnv {
+				return msg + " The rejected token is ZENNOTES_REMOTE_TOKEN from the MCP server's environment, which wins over one saved with `zn connect`: update it there, or remove it and run `zn connect " + serverURL + " --no-default` once in a terminal."
+			}
+		}
+		return msg + " The MCP server has no valid token for this ZenNotes server; the desktop app keeps its copy in the OS secret store, which zn cannot read. To fix it, " + tokenHint(serverURL)
 	}
 	return msg
 }
 
+// tokenHint says how to hand zn a server token. `--no-default` matters: a
+// plain `zn connect` also makes the server zn's own default, and an MCP
+// server in terminal mode would then stop following the app.
+func tokenHint(serverURL string) string {
+	if serverURL == "" {
+		serverURL = "<server-url>"
+	}
+	return "run `zn connect " + serverURL + " --no-default` once in a terminal (it saves the token where zn and this MCP server look, and the next call uses it), or set ZENNOTES_REMOTE_TOKEN in the MCP server's environment."
+}
+
 // Payload renders a tool result the way the desktop server does: a string
 // as-is, anything else as two-space-indented JSON.
 func Payload(result any) (string, error) {
@@ -1052,14 +1073,14 @@ func Run(ctx context.Context, opts Options) error {
 			}
 			b, previous, err := vaults.backendFor(def.name == "vault_info")
 			if err != nil {
-				return errorResult("Error: " + DescribeToolError(err)), nil
+				return errorResult("Error: " + DescribeToolError(err, nil)), nil
 			}
 			if previous != nil {
 				ctx = context.WithValue(ctx, previousVaultKey{}, *previous)
 			}
 			result, err := def.handler(ctx, args(a), b)
 			if err != nil {
-				return errorResult("Error: " + DescribeToolError(err)), nil
+				return errorResult("Error: " + DescribeToolError(err, b)), nil
 			}
 			payload, err := Payload(result)
 			if err != nil {