@ivanbard/dd2l 0.1.0 → 0.1.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 ivanbard
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 ivanbard
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -10,14 +10,53 @@ your materials, and ask questions with sources.
 - sign in to onQ through Chrome, including your school's MFA
 - collect course materials, assignments, grades, announcements and syllabus text
 - search the local cache, browse sources, and customize your home screen widgets
-- optionally connect ChatGPT for answers grounded in matching course excerpts
+- connect ChatGPT to compose adaptive workspaces around your goals
+
+Connect ChatGPT in Settings to use your existing plan, then describe what you
+want to do: **“Help me get ready for tomorrow's seminar”**, **“What should I
+prioritize across my classes?”**, or **“I'm stuck on the filter design report.”**
+The connected model interprets the goal, selects relevant records across
+courses, and generates an interactive workspace: a planner, practice session,
+rubric explorer, calculator, or another layout suited to the task. There is no required prompt format or fixed set of
+supported task names. If it needs clarification, answer in the same composer.
+
+Follow-ups carry the workspace's goal, generated interface and local progress, so
+you can change the layout while retaining notes and checked items. Use **Sources**
+to inspect verified coursework, or **Restart progress** to reset the current canvas. A connected model is selected by default;
+requests run only when you send a prompt, with the sharing notice visible.
+Choose **Local search** for keyword search and deterministic assignment views
+without sending data to AI. New search clears the goal; changing course clears
+context and sets a hard scope for the next request.
+
+The model can discover course areas, read uncached documents, and follow supported
+document links through the connector before composing the workspace. Retrieved
+materials enter the same cache used by search and sync. This covers accessible
+course content, assignment instructions/rubrics/attachments, your submission or
+quiz history, discussions, grades, announcements and calendar information.
+
+Adaptive requests use planning followed by interface generation from selected
+excerpts. Live research adds planning turns, bounded to four read rounds and eight
+connector operations per request. Generated HTML/CSS
+renders inside an isolated frame; JavaScript runs in a network-blocked worker
+through a small state/event interface. No frontend framework or external
+inference service is required. Local progress lasts for the current visit. Missing, inaccessible,
+and stale records remain explicit. Cached submissions do not confirm current
+submission status, and generated guidance should be checked against its sources.
 
 The connector is read-only. It does not submit work or change grades, posts,
 quiz attempts or completion states. Coverage depends on what onQ makes accessible.
+Live research uses approved API and document readers; it cannot click through
+arbitrary pages or sign into private external course tools.
 
 ## School not listed?
-If your school/educational faculty uses D2L Brightspace and is not available during setup, please open an issue in the GitHub repo with some details as to your 
-provider's Brightspace link and faculty name. Feel free to also create a PR if you have added your own solution to your school not being listed.
+Choose **My school isn't listed** during setup and paste your school's
+Brightspace address; `https://` is added if omitted. dd2l uses that site for sign-in, syncing, and source links, and
+remembers it for later launches. Other schools have not been verified; their
+authentication or API access may differ. You can also [report a missing school](https://github.com/ivanbard/dd2l/issues/new?template=missing-url.yml)
+using the guided issue form. Include your school's name and Brightspace URL if
+known to help add official support.
+Stop dd2l and run `dd2l logout` before switching schools; this deletes its saved
+school session and coursework cache.
 
 ## Run
 
@@ -25,7 +64,7 @@ Requires Windows, Node.js 24 or newer, and Google Chrome. This repository includ
 an npm CLI; the commands below work once the package is published to npm:
 
 ```powershell
-npx dd2l setup
+npx @ivanbard/dd2l setup
 ```
 
 Setup explains local storage, asks before connecting onQ, opens Chrome for school
@@ -34,10 +73,10 @@ one terminal open; Ctrl+C stops both the app and sync. The initial view may be
 empty while collection runs. Collection advances through up to five courses per
 pass every 15 minutes, so the first pass is not a complete download.
 
-Next time, run `npx dd2l start`. If the school session expires, stop the app and
-run `npx dd2l setup` again. Optional ChatGPT sign-in is in Settings.
+Next time, run `npx @ivanbard/dd2l start`. If the school session expires, stop the app and
+run `npx @ivanbard/dd2l setup` again. Optional ChatGPT sign-in is in Settings.
 
-Alternatively, install globally with `npm install -g dd2l`, then use `dd2l setup`
+Alternatively, install globally with `npm install -g @ivanbard/dd2l`, then use `dd2l setup`
 and `dd2l start`. Installation itself does not open browsers or connect accounts;
 setup runs explicitly in an interactive terminal.
 
@@ -64,7 +103,7 @@ cache lives in `%LOCALAPPDATA%\dd2l` and is **not encrypted**. Local search does
 not send your question to an AI provider.
 
 For AI answers, connect ChatGPT in Settings and choose a model below the prompt.
-Submitting sends your question and matching course excerpts to OpenAI and uses
+Submitting sends your goal, previous workspace context, course previews and selected excerpts to OpenAI and uses
 your plan's limits. Check generated answers against the supplied sources.
 
 Stop the app, then run `dd2l logout` (or `npm start -- logout` from source) to

package/bin/dd2l.mjs

@@ -1,7 +1,7 @@
-#!/usr/bin/env node
-if (Number(process.versions.node.split('.')[0]) < 24) {
-  console.error('dd2l requires Node.js 24 or newer. Install it from https://nodejs.org, then retry.');
-  process.exitCode = 1;
-} else {
-  await import('../src/cli.mjs');
-}
+#!/usr/bin/env node
+if (Number(process.versions.node.split('.')[0]) < 24) {
+  console.error('dd2l requires Node.js 24 or newer. Install it from https://nodejs.org, then retry.');
+  process.exitCode = 1;
+} else {
+  await import('../src/cli.mjs');
+}

package/docs/README.md

@@ -6,14 +6,22 @@ The connector signs in using your installed Google Chrome browser, reuses a prot
 
 ## Run
 
+Setup lists Queen's onQ and lets you enter another school's HTTPS Brightspace
+URL. The `https://` prefix is optional and added automatically. Pasted course URLs are reduced to their site origin; credentials embedded
+in a URL are rejected. The selected site is saved after successful sign-in and
+reused by subsequent connector commands and cached source links. Existing
+Queen's installations keep working without setup changes. Other schools remain
+unverified; use the issue link shown during setup to request official support.
+Stop the worker and run `logout` before switching accounts or schools.
+
 The guided source-checkout path is `npm ci`, then `npm run setup`. Setup asks
 before connecting onQ, completes school sign-in, opens the UI, and runs sync in
 the same terminal. Use `npm start -- start` on later launches. Keep the terminal
 open; Ctrl+C stops both. If sign-in expires, rerun setup. Collection remains
 incremental, with the same batching and 15-minute cadence described below.
 
-The npm package exposes `dd2l setup` and `dd2l start` (or `npx dd2l setup` and
-`npx dd2l start` without a global install) once published. It has no interactive
+The npm package exposes `dd2l setup` and `dd2l start` (or `npx @ivanbard/dd2l setup` and
+`npx @ivanbard/dd2l start` without a global install) once published. It has no interactive
 install hook. The repository has not been published by this setup change.
 
 For manual operation:
@@ -55,7 +63,7 @@ npm run ui
 
 Open the printed [local URL](http://127.0.0.1:4173). The home screen implements the [Figma Home design](https://www.figma.com/design/ASr0dnwupPLbXmeT1AiPGg/dd2l?node-id=1-3): prompt, course selector, sidebar and profile. Search finds keyword matches in cached course materials and displays source excerpts with retrieval dates and stale-cache labels. Courses opens a material browser; Settings and Profile show connection status and refresh instructions. The source link opens the course in onQ using your normal browser sign-in.
 
-Local search reads the existing inventory without changing it or loading school credentials. Run `npm run audit -- --all` or keep `npm run sync -- --all` running separately to collect data. Each search reads the current cache. Only courses confirmed accessible in cached enrollments are shown; unavailable material stays unavailable, and coverage is limited to what the connector has collected. The mode dropdown beside the course selector defaults to **Local search**, which matches keywords; choosing a connected ChatGPT model generates grounded answers when you submit.
+Local search reads the existing inventory without changing it or loading school credentials. Run `npm run audit -- --all` or keep `npm run sync -- --all` running separately to collect data. Each search reads the current cache. Only courses confirmed accessible in cached enrollments are shown; unavailable material stays unavailable, and coverage is limited to what the connector has collected. The mode dropdown uses an available ChatGPT model when connected, or **Local search** otherwise. Local search matches keywords; submitting with a connected model builds a workspace around your goal.
 
 The homescreen includes upcoming deadlines, recent class announcements, and shortcuts to classes or cached materials. **Customize** enables a four-column, eight-row grid: drag a widget to move it live, or drag any edge or corner to resize it. A cell preview marks the proposed placement; overlapping or out-of-bounds drops return to the original position. Escape cancels the gesture. Focus a widget and use arrow keys to move or Shift + arrows to resize without a pointer. Remove widgets or add them back with **Add widget**. Narrow screens stack widgets normally and show a horizontally scrollable grid while customizing. **Pin shortcut** opens a searchable class/material picker; selecting a shortcut browses its cached sources. New search returns to the homescreen.
 
@@ -65,13 +73,102 @@ Layouts and up to 20 shortcut references save in browser local storage, separate
 
 ### Use your ChatGPT plan
 
-In the live UI, open Settings or Profile and choose **Continue with ChatGPT**. Complete registration and plan-use consent on OpenAI's website, then return to dd2l. No API key is needed. The small mode dropdown below the prompt starts on **Local search**, even with a connected account. Choose a model to see the coursework-sharing notice, then press Enter or the send button to ask it. Changing the selection never submits a prompt. Select **Local search** to return to local retrieval; reloading or starting a new search also restores that default. Plan and usage information stays in Settings.
-
-Each AI request sends the question and up to eight matching excerpts (at most 700 characters each), including titles, course names, retrieval dates and stale-cache labels, to OpenAI. The answer displays those sources with numbered references. The model is instructed to use only this evidence and report gaps; verify generated claims against the excerpts. Keyword retrieval can miss relevant material. No tool execution, Brightspace credentials, complete inventory upload, or persistent conversation history is provided. Each submission with an AI model selected grants permission for that answer; local mode never sends the question to an AI provider. Editing the question or changing modes or courses cancels an in-flight answer.
-
-AI answers can compose interactive checklists, comparison tables, and grouped source cards in the same matte printed style as the homescreen widgets. The selected model chooses useful sections or plain text for a simple question. The Responses request uses [Structured Outputs](https://developers.openai.com/api/docs/guides/structured-outputs) with a bounded JSON schema; the app validates the result and citation numbers before rendering trusted components. No model-generated HTML, scripts, URLs or styling execute. Invalid layouts fall back to a bounded text summary and the available sources, with a notice; incomplete streams still fail rather than appearing successful. Provider refusals display as text. A model must support the structured-output format; errors do not trigger another model or a second billed request.
-
-Checklist checks and progress belong to the current answer and reset on a new question. They do not update Brightspace or save to your homescreen. Every generated item or comparison row links to supplied source excerpts; stale cache labels remain visible. Valid structure and citations do not prove factual correctness or complete course coverage. Source retrieval still uses the existing keyword search and its limits.
+In the live UI, open Settings or Profile and choose **Continue with ChatGPT**.
+Complete registration and plan-use consent on OpenAI's website, then return to
+dd2l. No API key is needed. An available connected model is selected by default;
+the sharing notice identifies AI mode. Sending a prompt starts a request;
+loading the app, typing and changing models never send coursework. Choose
+**Local search** for local keyword retrieval and assignment views. New search
+clears workspace context and restores the connected model default.
+
+Adaptive mode has no assignment-specific prompt gate or fixed intent list.
+The first model call receives the request, prior workspace goal and selected
+source references, accessible course names, and up to 400 catalogue previews
+(maximum 400 characters of source text each). Catalogue selection includes
+keyword matches, previous references, and diverse course/category records.
+When evidence is missing, stale, or needs a current check, the model can request
+read-only connector operations and plan again. It can discover courses and course
+areas, read discovered content files, assignment details/rubrics/own status and
+attachments, quiz metadata/own attempts, discussion forums/topics/posts, overview
+attachments, grades, announcements and calendar events. Supported document links
+can be followed from those resources. Discovery returns request-local handles;
+the model cannot supply arbitrary network URLs. New observations update the same
+inventory, without changing the sync course or traversal cursors. Freshly retrieved
+records receive priority in the next catalogue.
+
+Research allows at most two operations per planning turn, four read rounds and
+eight connector operations. A final planning turn must finish with available
+evidence or explain what is missing. Requests have a five-minute overall deadline;
+each operation may involve several bounded API/document reads. Calendar discovery
+covers the previous 30 and next 120 days. Live reads share the connector queue with
+sync, so an in-progress course pass can delay them. Use the UI opened by `dd2l start`
+to share its connector; standalone `npm run ui` acquires the inventory lock for each
+operation and reports if another command owns it.
+
+The model chooses source IDs and purpose-specific groups in relevance order,
+or asks for clarification. The server validates the plan, enforces the selected
+course scope, and rechecks current access before assembling sources.
+
+After planning, another model call generates a workspace program: title, short answer, HTML
+fragment (up to 60,000 characters), CSS (20,000), and a JavaScript function body
+(60,000), grounded in up to 24 selected excerpts of 8,000 characters each. The
+interface can be a planner, practice session, rubric explorer, form, diagram or
+calculator. It is not limited to a catalogue of prebuilt task widgets. All calls
+use the selected model and plan limits: normally two calls, up to five planning
+calls plus one canvas call when researching. Clarifications use only planning. Failed
+generation retains the verified source view; no retries or fallback models are
+billed automatically. Sources and cache coverage remain available from **Sources**.
+
+The implementation uses browser primitives rather than introducing React and a
+second agent runtime. The dedicated frame has an opaque origin and restrictive
+CSP. Only the trusted frame runtime touches the DOM. Generated JavaScript runs
+in a Blob worker with network access blocked, no DOM or frame navigation, opaque-origin storage restrictions,
+and a two-second response watchdog. Generated HTML is sanitized to semantic HTML,
+form controls and SVG geometry; scripts, embedded frames, event handlers and
+navigation/resource URLs are removed. CSS remains confined to the frame. This
+follows the isolated generative canvas pattern while keeping the current server
+and ChatGPT authentication path.
+
+The generated function receives `state`, `event`, and selected `sources`, and
+returns `{html, state}`. Events include click actions (`data-action`), named input
+changes and submissions. Named controls are saved/restored automatically in
+`state.inputs`; text controls accept up to 4,000 characters each. State must be
+JSON data under 32,000 characters and twelve levels deep. The app waits for
+pending worker updates before collecting progress for a follow-up. Generated
+programs can also keep tabs, revealed explanations, scenario values and other
+local state. Rendering applies the newest queued input so older results do not
+overwrite typing.
+
+A `data-source` button requests inspection of a selected source. The host
+validates that source ID, re-reads current access, then displays a trusted source
+panel and a Brightspace link. The generated program receives no credential,
+arbitrary fetch, file, submission, or host navigation capability. Source URLs
+come from dd2l, not generated HTML. API source references stop resolving after
+access is revoked.
+
+Follow-ups send the previous goal, selected IDs, bounded guidance summary, prior
+program, current progress and any runtime error to the selected model. Prior
+context and coursework are untrusted data in model instructions. **New search**
+and course changes clear the canvas and context; **Restart progress** reruns the
+current program with empty state. Progress is held in browser memory and clears
+on reload. Editing a prompt cancels generation without discarding the current
+canvas. The app enforces bounded JSON input and output, but a valid program may
+still contain factual, calculation or usability errors. Check its linked
+coursework and identify what to fix in a follow-up.
+
+Each explicit submission with a model selected authorizes live read-only discovery
+and sharing its results, those previews, excerpts, the previous program and local
+progress with OpenAI. Local mode sends
+none of them. Brightspace remains read-only. The model cannot invent missing
+course records or submit work. Catalogue coverage remains bounded and is shown
+in the source view when incomplete.
+
+School identity and current enrollment are checked for each operation; hidden or
+removed parents cannot authorize child reads. Login expiry and rate limiting stop
+further research, with the result shown in Sources; cached evidence may still be
+used with its freshness labels. This is an API/document read graph, not arbitrary
+browser clicking. It cannot start quizzes, submit assignments, enumerate class
+rosters, or sign into private LTI providers. Unsupported links remain gaps.
 
 This uses OpenAI's documented [local-app Sign in with ChatGPT flow](https://developers.openai.com/siwc/token-sharing-open-source), with PKCE, state/nonce and signed identity validation. A stable host ID and separate account registrations are saved under `%LOCALAPPDATA%\dd2l\llm\accounts.dpapi`, encrypted with Windows DPAPI. Refreshes are serialized across processes using a separate lock; the school sync can run alongside AI. Tokens stay on the server and never enter browser storage. `jose` handles JWT signature and claim verification. Remote Responses requests set `store: false` and `stream: true`; partial/failed streams do not become successful answers.
 
@@ -125,6 +222,6 @@ Syllabus content lives in individual `syllabus_source` resource rows; the `sylla
 
 An audit can complete successfully as a command while reporting `complete: false`: resource-level denials, unavailable routes, or partial collections remain visible. A successful collection read establishes coverage of that endpoint, not of every activity the website or an external tool may contain.
 
-Improved semantic retrieval, additional model providers, private course-content provider integrations and unattended Windows startup remain later milestones.
+Persistent semantic indexing, additional model providers, private course-content provider integrations and unattended Windows startup remain later milestones.
 
 Do not commit credentials, session cookies, access tokens, downloaded coursework, grades, or classmates' personal information. Discovery evidence should contain access outcomes and field names rather than private payloads.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ivanbard/dd2l",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "A local, read-only student companion for Queen's onQ: sync coursework, search sources, and optionally connect ChatGPT.",
   "license": "MIT",
   "repository": {
@@ -33,7 +33,7 @@
     "start": "node src/cli.mjs",
     "setup": "node src/cli.mjs setup",
     "ui": "node src/ui-server.mjs",
-    "ui:check": "node scripts/check-ui.mjs",
+    "ui:check": "node scripts/check-ui.mjs && node scripts/check-canvas.mjs",
     "test": "node --test",
     "package:check": "node scripts/check-package.mjs",
     "release:check": "npm test && npm run ui:check && npm run package:check",
@@ -45,6 +45,7 @@
     "soak": "node scripts/soak-sync.mjs"
   },
   "dependencies": {
+    "@clack/prompts": "^1.8.1",
     "@napi-rs/canvas": "^1.0.13",
     "fflate": "^0.8.3",
     "htmlparser2": "12.0.0",

package/src/app-runner.mjs

@@ -1,35 +1,58 @@
-import { execFile } from 'node:child_process';
-import { createUiServer } from './ui-server.mjs';
-import { sync } from './connector.mjs';
-
-function openBrowser(url) {
-  return new Promise((resolve, reject) => {
-    execFile('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
-      `Start-Process -FilePath '${url}' -WindowStyle Hidden`], { windowsHide: true, timeout: 15_000 },
-    error => error ? reject(error) : resolve());
-  });
-}
-
-export async function runApp(connector, { onUpdate, server = createUiServer(),
-  open = openBrowser, signals = process, port = 4173, log = console.log } = {}) {
-  const controller = new AbortController();
-  const stop = () => controller.abort();
-  signals.on('SIGINT', stop);
-  signals.on('SIGTERM', stop);
-  try {
-    await new Promise((resolve, reject) => {
-      server.once('error', reject);
-      server.listen(port, '127.0.0.1', resolve);
-    });
-    const url = `http://127.0.0.1:${server.address().port}`;
-    log(`dd2l: ${url}\nKeep this terminal open. Ctrl+C stops the app and sync.`);
-    log('Collecting coursework now; the first view may be empty. Collection is incremental, up to five courses per pass, every 15 minutes.');
-    try { await open(url); }
-    catch { log(`Could not open your browser. Open ${url} manually.`); }
-    await sync(connector, { all: true }, { signal: controller.signal, onUpdate });
-  } finally {
-    signals.off('SIGINT', stop);
-    signals.off('SIGTERM', stop);
-    await new Promise(resolve => server.close(resolve));
-  }
-}
+import { execFile } from 'node:child_process';
+import { createUiServer } from './ui-server.mjs';
+import { sync } from './connector.mjs';
+import { log as terminalLog, spinner } from '@clack/prompts';
+
+function openBrowser(url) {
+  return new Promise((resolve, reject) => {
+    execFile('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+      `Start-Process -FilePath '${url}' -WindowStyle Hidden`], { windowsHide: true, timeout: 15_000 },
+    error => error ? reject(error) : resolve());
+  });
+}
+
+export async function runApp(connector, { onUpdate, server,
+  open = openBrowser, signals = process, port = 4173, log = terminalLog.info } = {}) {
+  const controller = new AbortController();
+  server ??= createUiServer({ connector, shutdownSignal: controller.signal });
+  const progress = process.stdout.isTTY ? spinner({ signal: controller.signal }) : null;
+  let firstPass = true;
+  const stop = () => controller.abort();
+  signals.on('SIGINT', stop);
+  signals.on('SIGTERM', stop);
+  try {
+    await new Promise((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(port, '127.0.0.1', resolve);
+    });
+    const url = `http://127.0.0.1:${server.address().port}`;
+    log(`Your workspace → ${url}\nKeep this terminal open; Ctrl+C stops the app and sync.`);
+    try { await open(url); }
+    catch { log(`Could not open your browser. Open ${url} manually.`); }
+    log('Collecting up to 5 courses per pass, every 15 minutes.\nThe app may be empty until the first batch is ready.');
+    progress?.start('Collecting your first batch of coursework');
+    await sync(connector, { all: true }, { signal: controller.signal, onUpdate: async summary => {
+      await onUpdate?.(summary);
+      const message = summary.state === 'retry_wait'
+        ? 'Collection delayed · will retry automatically'
+        : 'Coursework saved · reopen Courses or search to see updates';
+      if (progress && firstPass) {
+        if (summary.state === 'retry_wait') { progress.clear(); terminalLog.warn(message); }
+        else progress.stop(message);
+      }
+      else log(message);
+      if (firstPass && summary.state !== 'retry_wait') {
+        log('Local search is ready. Connect ChatGPT in Settings for AI answers.');
+      }
+      firstPass = false;
+    } });
+  } catch (error) {
+    progress?.error('Collection stopped');
+    throw error;
+  } finally {
+    progress?.clear();
+    signals.off('SIGINT', stop);
+    signals.off('SIGTERM', stop);
+    await new Promise(resolve => { server.close(resolve); server.closeAllConnections(); });
+  }
+}

package/src/assignment-workspace.mjs

@@ -0,0 +1,128 @@
+import { htmlContent } from './documents.mjs';
+
+const numeric = value => /^\d+$/.test(String(value ?? ''));
+const visible = value => value && !value.IsHidden && !value.IsLocked && !value.IsDeleted && value.IsPublished !== false;
+const readable = row => row?.data != null && !['denied', 'not_configured'].includes(row.outcome);
+const normalize = value => String(value).toLowerCase().replace(/[^\p{L}\p{N}]+/gu, ' ').trim();
+const date = value => Number.isFinite(Date.parse(value)) ? value : null;
+const fields = new Set(['Name', 'Title', 'Description', 'Instructions', 'Text', 'Html', 'text',
+  'Criteria', 'CriteriaGroups', 'Levels', 'Rubrics', 'Feedback', 'FeedbackText', 'Points', 'MaxPoints', 'Score', 'OutOf']);
+
+// Project only coursework fields: never expose raw responses, retained bytes, or credentials.
+function courseworkText(value, depth = 0) {
+  if (depth > 10 || value == null) return '';
+  if (typeof value === 'string' || typeof value === 'number') return String(value);
+  if (Array.isArray(value)) return value.map(item => courseworkText(item, depth + 1)).filter(Boolean).join('\n');
+  if (!visible(value)) return '';
+  if (value.Html) return htmlContent(value.Html).text;
+  return Object.entries(value).filter(([key]) => fields.has(key))
+    .map(([key, item]) => `${['Points', 'MaxPoints', 'Score', 'OutOf'].includes(key) ? `${key}: ` : ''}${courseworkText(item, depth + 1)}`)
+    .filter(Boolean).join('\n');
+}
+
+function state(row) {
+  if (!row) return 'missing';
+  if (row.outcome === 'denied') return 'inaccessible';
+  if (row.outcome === 'not_configured') return 'not_configured';
+  return readable(row) ? row.outcome === 'available' ? 'available' : 'stale' : 'missing';
+}
+
+export function projectAssignments(rows, courses, origin) {
+  const assignments = [];
+  for (const course of courses) {
+    const scoped = rows.filter(row => String(row.course) === course.id);
+    const listing = scoped.find(row => row.category === 'assignments');
+    if (!readable(listing) || !Array.isArray(listing.data)) continue;
+    for (const folder of listing.data.filter(item => numeric(item.Id) && visible(item))) {
+      const id = String(folder.Id);
+      const related = scoped.filter(row => {
+        const path = row.key || '';
+        return path.match(/\/dropbox\/folders\/(\d+)(?:\/|$)/)?.[1] === id ||
+          (row.category === 'rubrics' && new URL(path, origin).searchParams.get('objectId') === id);
+      });
+      const detail = related.find(row => row.category === 'assignment_detail');
+      if (readable(detail) && !visible(detail.data)) continue;
+      const data = { ...folder, ...(readable(detail) ? detail.data : {}) };
+      const url = `${origin}/d2l/lms/dropbox/user/folder_submit_files.d2l?db=${id}&ou=${course.id}`;
+      const record = (kind, title, row, text = readable(row) ? courseworkText(row.data) : '') => ({
+        id: `${course.id}:${id}:${kind}:${row?.key || title}`, resourceKey: row?.key || null, course: course.id, courseName: course.name,
+        category: kind, title, text: text.length > 100_000 ? `${text.slice(0, 100_000)}\n[Excerpt truncated. Open Brightspace for the full source.]` : text, status: state(row),
+        stale: state(row) === 'stale', lastSuccess: row?.last_success || null, checkedAt: row?.checked_at || null, url,
+      });
+      const instructions = courseworkText(data.Instructions) || courseworkText(data.Description);
+      const records = [record('instructions', 'Instructions and deliverables', readable(detail) ? detail : listing, instructions)];
+      const rubric = related.find(row => row.category === 'rubrics');
+      const embedded = data.Assessment?.Rubrics;
+      records.push(rubric ? record('rubric', 'Rubric', rubric) : embedded?.length
+        ? record('rubric', 'Rubric', readable(detail) ? detail : listing, courseworkText(embedded))
+        : record('rubric', 'Rubric', null));
+      const submissions = related.find(row => row.category === 'own_submissions');
+      // A complete empty response establishes no submissions; a missing read does not.
+      let submissionStatus = 'Submission status not retrieved';
+      if (readable(submissions) && Array.isArray(submissions.data)) {
+        const count = submissions.data
+          .reduce((total, entity) => total + (entity.Submissions?.length || 0), 0);
+        submissionStatus = count ? `${count} cached submission${count === 1 ? '' : 's'}` : 'No submissions in the cached response';
+        if (state(submissions) === 'stale') submissionStatus += ' · stale';
+      } else if (state(submissions) === 'inaccessible') submissionStatus = 'Submission status inaccessible';
+      const feedback = related.find(row => row.category === 'own_feedback');
+      records.push(record('feedback', 'Your feedback', feedback));
+      for (const attachment of data.Attachments || []) {
+        if (!numeric(attachment.FileId) || !visible(attachment)) continue;
+        const file = related.find(row => row.category === 'assignment_file' && row.key.endsWith(`/attachments/${attachment.FileId}`));
+        records.push(record('attachment', attachment.FileName || attachment.Name || `Attachment ${attachment.FileId}`, file));
+      }
+      assignments.push({ id, course: course.id, courseName: course.name, title: data.Name || `Assignment ${id}`,
+        dueDate: date(data.DueDate), startDate: date(data.Availability?.StartDate || data.StartDate),
+        endDate: date(data.Availability?.EndDate || data.EndDate), submissionStatus, url,
+        stale: state(listing) === 'stale' || state(detail) === 'stale', lastSuccess: (readable(detail) ? detail : listing).last_success || null,
+        records });
+    }
+  }
+  return assignments;
+}
+
+export function assignmentWorkspace(inventory, query, course = '', assignmentId = '') {
+  const normalized = normalize(query);
+  const number = normalized.match(/\b(?:assignment|assign|a|hw|homework)\s*0*(\d+)\b/)?.[1];
+  const courseMatches = inventory.courses.filter(item => {
+    const codes = [...normalize(item.name).matchAll(/\b([a-z]{2,})\s*(\d{3,4})\b/g)];
+    return codes.some(code => new RegExp(`\\b${code[1]}\\s*${code[2]}\\b`).test(normalized));
+  });
+  // An explicitly named course takes precedence over context from the previous request.
+  const namedCourses = courseMatches.map(item => item.id);
+  const unknownCourse = !namedCourses.length && /\b(?!assignment\b|homework\b)[a-z]{2,}\s*\d{3,4}\b/.test(normalized);
+  let candidates = (inventory.assignments || []).filter(item => namedCourses.length ? namedCourses.includes(item.course) : !course || item.course === course);
+  if (unknownCourse && number) candidates = [];
+  if (number) candidates = candidates.filter(item => normalize(item.title).match(/\b(?:assignment|assign|a|hw|homework)\s*0*(\d+)\b/)?.[1] === number);
+  else {
+    const titles = candidates.filter(item => normalized.includes(normalize(item.title)));
+    if (titles.length) candidates = titles;
+    else if (assignmentId && !namedCourses.length && !/\b(?:assignment|homework|quiz|test|exam)\b/.test(normalized)) candidates = candidates.filter(item => item.id === assignmentId);
+    else if (!/\b(?:assignment|homework)\b/.test(normalized)) return null;
+  }
+  if (candidates.length > 1 && assignmentId && course) {
+    const selected = candidates.filter(item => item.id === assignmentId && item.course === course);
+    if (selected.length) candidates = selected;
+  }
+  const choices = candidates.map(({ id, course, courseName, title }) => ({ id, course, courseName, title }));
+  if (candidates.length !== 1) return { status: candidates.length ? 'choose' : 'missing', choices };
+  const target = candidates[0];
+  const title = normalize(target.title);
+  const shortTitle = title.match(/\b(?:assignment|homework|hw)\s*\d+\b/)?.[0] || title;
+  const instructions = normalize(target.records.find(record => record.category === 'instructions')?.text || '');
+  const supporting = inventory.sources.filter(source => source.course === target.course &&
+    ['content', 'content_file', 'linked_content', 'syllabus_source', 'announcements'].includes(source.category))
+    .map(source => {
+      const name = normalize(source.title), body = normalize(source.text);
+      const mentions = value => (` ${value} `).includes(` ${shortTitle} `);
+      const reason = mentions(name) || mentions(body) ? 'Mentions this assignment'
+        : name.length > 8 && instructions.includes(name) ? 'Referenced in the assignment instructions'
+          : source.category === 'syllabus_source' ? 'Course policy reference' : '';
+      return { ...source, status: source.stale ? 'stale' : 'available', reason };
+    }).filter(source => source.reason).sort((a, b) => (a.reason === 'Course policy reference') - (b.reason === 'Course policy reference')).slice(0, 6);
+  const submitting = /\b(submit|submission|ready|hand in)\b/.test(normalized);
+  const order = submitting || /\b(rubric|criterion|criteria)\b/.test(normalized) ? ['rubric', 'instructions', 'attachment', 'feedback'] : ['instructions', 'attachment', 'rubric', 'feedback'];
+  const records = [...target.records].sort((a, b) => order.indexOf(a.category) - order.indexOf(b.category));
+  return { status: 'resolved', ...target, records, supporting, intent: submitting ? 'submit' : 'work' };
+}

package/src/canvas.mjs

@@ -0,0 +1,17 @@
+import { randomBytes } from 'node:crypto';
+import { canvasRuntime } from '../ui/canvas-runtime.js';
+import { validCanvasState } from '../ui/canvas-contract.js';
+
+export function canvasDocument() {
+  const nonce = randomBytes(24).toString('base64');
+  return {
+    policy: `sandbox allow-scripts; default-src 'none'; script-src 'nonce-${nonce}' 'unsafe-eval'; worker-src blob:; style-src 'unsafe-inline'; img-src data:; connect-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'self'`,
+    html: `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><style>
+      :root { color-scheme: dark; font-family: system-ui,sans-serif; color:#e8e9e6; background:#222; }
+      * { box-sizing:border-box; } body { margin:0; overflow-wrap:anywhere; } #canvas { padding:20px; }
+      button,input,select,textarea { font:inherit; } button { cursor:pointer; } :focus-visible { outline:2px solid #9bd1df; outline-offset:3px; }
+      pre { white-space:pre-wrap; } svg { max-width:100%; } input,textarea,select { max-width:100%; }
+      @media(prefers-reduced-motion:reduce) { *,*::before,*::after { animation:none!important; transition:none!important; } }
+      </style><style id="generated-style"></style></head><body><main id="canvas"></main><script nonce="${nonce}">(${canvasRuntime.toString()})(${validCanvasState.toString()});</script></body></html>`,
+  };
+}