@jamestesting888/tum-mcp 0.5.0 → 0.6.1

package/docs/tum-mcp.md

@@ -1,52 +1,50 @@
 # TUM MCP guide
 
 Package: `@jamestesting888/tum-mcp`, CLI: `tum-mcp`, backend: Python 3.13.
-Version **0.5.0** provides interactive service and browser selection, local-file
-credential keys, richer diagnostics, Cursor/Antigravity adapters, and WSL-backed
-Windows client setup. The package supports campus reads and local assignment
-assistance; remote-action tools remain disabled.
+Development version **0.6.1 (unreleased)** adds npm package management to the
+read-only course retrieval and five local study workflows in 0.6.0.
 
 ## Current capabilities
 
-The campus server preserves all sixteen `moodle_*` tools and the existing Moodle
-session/keychain identity. It adds scoped Zulip channel search/topic reads,
-released Artemis programming statements, exact-revision visible feedback,
-participation-bound workspace preparation, approved container test recipes,
-submission previews, and seven portable workflow skills.
-
-Remote start, push, submit, rebuild, Zulip posting, and DMs are unavailable.
-An internal, release-gated executor covers exact-action fingerprints, encrypted
-expiring one-use grants, account/scope/credential revalidation, and durable
-unknown-outcome receipts. Synthetic tests cover one POST or exact-commit push,
-copied/fabricated approvals, changed targets, and lost responses. No MCP write
-tool, approval issuer, or preference can open this version's gate.
-The internal executor is groundwork for Phase 5; no live-action certification is claimed.
-Revision 3 Phase 5 needs a demonstrated trusted approval/credential boundary and
-safe practice-exercise verification before those tools can be exposed. A
-submission preview never performs a commit or remote action. Native Git/browser
-tools available to an unrestricted host remain outside the MCP enforcement
-boundary; the server does not claim to prevent every host-level push.
-
-The verified public origins are `https://artemis.tum.de` and
-`https://zulip.cit.tum.de`. Public discovery on 24 October 2026 reported Artemis
-10.4, source revision `d8594cc5fb2f2ec276bd123861be7ff20c1b3cc0`, and Zulip 12.0,
-feature level 498, with TUM Shibboleth. No account permission follows from that
-public discovery. Provider routes were checked against that Artemis revision.
+The sixteen `moodle_*` tools provide materials, announcements, forums and
+explicitly scoped private-record reads. Artemis adds
+available-course metadata, lectures and learning units, student PDF attachments,
+released non-quiz statements and permitted exact-commit feedback. Zulip provides
+scoped channel/topic search and cited discussion reads.
+
+Website access is read-only. There are no public exercise workspace, test-run,
+submission, start, deployment, rebuild or push workflows.
+Local downloads, source inventories, study-site builds and checkpoint storage
+are local operations; they do not post, submit or mark campus content as read.
+
+Artemis lecture reads use the student overview/detail endpoints, verify the
+selected course and omit unreleased units and personal completion records.
+`artemis_get_attachment` retrieves a bounded page range from the student PDF,
+which excludes hidden slides, and optionally saves that copy locally. Original
+staff links are never fetched. Video/online links remain cited references;
+unsupported or external content is reported as a retrieval gap.
+
+Lecture routes were checked against the
+[Artemis source](https://github.com/ls1intum/Artemis/blob/88824427f7ea38512606824c58b8858e539eb2eb/src/main/java/de/tum/cit/aet/artemis/lecture/web/LectureResource.java)
+and the
+[student file boundary](https://github.com/ls1intum/Artemis/blob/88824427f7ea38512606824c58b8858e539eb2eb/src/main/java/de/tum/cit/aet/artemis/core/web/FileResource.java).
+Synthetic fixtures are the default. Live checks remain private and use explicit scopes.
 
 ## Build and test the local package
 
-For normal installation, use `npm install --global @jamestesting888/tum-mcp@0.5.0`
+For normal installation, use `npm install --global @jamestesting888/tum-mcp@latest`
 and `tum-mcp setup --client codex`. The following commands are for maintainers.
 
 ```sh
 uv sync --locked
-uv run ruff check src tests plugin/scripts scripts
-uv run ruff format --check src tests plugin/scripts scripts
+uv run ruff check src tests scripts
+uv run ruff format --check src tests scripts
 uv run pytest -q -m 'not live'
 node npm/build.mjs
 npm test
 npm pack --ignore-scripts --pack-destination dist
-npm run test:consumer -- dist/jamestesting888-tum-mcp-0.5.0.tgz
+npm run test:consumer
+npm run test:upgrade
 ```
 
 The npm artifact has an explicit file allowlist, a bundled backend wheel,
@@ -69,20 +67,19 @@ and Python 3.13.15; an existing matching uv, including the verified cached downl
 is reused. Source checkouts and system
 Python are unnecessary for consumers. Supported bootstrap targets are macOS
 arm64/x64, Windows arm64/x64, and glibc Linux arm64/x64; hands-on verification is
-recorded separately. New campus sessions use permission-restricted local keys and need no Secret Service.
-Clean consumer bootstrap, idempotent setup, diagnostics, and skill validation
-passed on macOS ARM64 and in Linux ARM64 and x86_64 containers. The x86_64 check
-ran through Docker amd64 emulation on an ARM64 Mac; packaged MCP protocol checks
-and an encrypted credential round trip through a real GNOME Secret Service in an
-isolated D-Bus session also passed. Real Linux desktop browser sign-in, macOS x64,
-and Windows hands-on checks remain open. New storage and terminal behavior need
-the current checkout’s test evidence; earlier native-store results do not certify them. The installer targets glibc Linux
-x86_64/amd64 and aarch64/ARM64.
-
-`update` provisions the backend bundled in the invoked package and preserves
-older runtime directories. To obtain a newer public package after publication,
-invoke its reviewed version explicitly. It does not publish a release or replace
-customized client skills silently. If interrupted setup leaves `setup.lock`,
+recorded separately. Campus sessions use permission-restricted local keys.
+CI checks clean installation, updates, removal, MCP discovery and synthetic
+browser workflows on macOS, Windows, Linux and both WSL engines. See the
+[development guide](development.md#checks) for the verification layers.
+
+`update` downloads and validates the latest release, replaces the invoked npm
+installation and refreshes previously configured clients. `update --local`
+refreshes the installed version without npm. Retained runtimes keep pinned
+clients working, and newer installed versions are not silently downgraded.
+[Update and removal behavior](setup.md#update-and-remove) covers ownership
+receipts, conflict handling and explicit cleanup. `uninstall` removes managed
+clients and npm; `--client NAME` or `--keep-package` retains the package.
+Customized files and saved data are preserved. If interrupted setup leaves `setup.lock`,
 confirm that no setup process is running before removing that directory locally.
 An invalid or incomplete runtime is never selected for serving. Failed validation
 clears its ready marker so explicit setup can rebuild it; older runtimes remain
@@ -92,7 +89,7 @@ rerun its setup to restore that runtime, reviewing any client configuration diff
 For platforms outside the bootstrap targets, the source installation needs
 Python 3.13+, uv, and Git: run `uv sync --locked`, then
 `uv run tum-mcp setup --client generic` from the checkout. An installed Chromium browser is needed for
-browser onboarding. See [setup](setup.md) for browser choices and WSL. Docker is needed only for isolated assignment tests.
+browser onboarding. See [setup](setup.md) for browser choices and WSL.
 
 ## Connections and scopes
 
@@ -101,17 +98,16 @@ tum-mcp connect
 tum-mcp status
 tum-mcp discover artemis ACCOUNT_ID
 tum-mcp discover zulip ACCOUNT_ID
-tum-mcp scope artemis ACCOUNT_ID --course COURSE_ID --sensitive --workspace
+tum-mcp scope artemis ACCOUNT_ID --course COURSE_ID --sensitive
 tum-mcp scope zulip ACCOUNT_ID --channel CHANNEL_ID
 ```
 
 `connect` takes no arguments or connection options. Move with up/down, toggle
 services with Space, and press Enter. Choose a browser when more than one is
 installed. Only selected tabs open in one temporary browser context. Moodle,
-Artemis and Zulip all follow this flow; no separate Moodle login is needed.
+Artemis and Zulip all follow this flow.
 Sign-in/MFA stays in the browser. `TERM=dumb` uses numbered prompts. Ctrl+C
-cancels and retains completed connections. Old service/campus arguments and
-`--service`/`--auth` flags are rejected before any browser opens.
+cancels and retains completed connections.
 
 Detection covers Chrome, Edge, Brave, Chromium, Vivaldi, Opera and selected
 preview channels. Set `TUM_MCP_BROWSER` to an executable path for another
@@ -121,48 +117,30 @@ Only service-owned cookies are saved; identity-provider cookies are discarded
 when the temporary browser closes. Existing browser profiles are never imported.
 
 Zulip uses its read-only `/json/` routes with the browser session; no API key is
-required. Reconnect through the same selector when a session expires. Existing
-API-key records remain readable for compatibility, but key entry is not part of
-onboarding. See [Zulip's dispatcher](https://github.com/zulip/zulip/blob/12.0/zerver/lib/rest.py).
-Browser login and Artemis Git access remain
-separate capabilities. Existing scopes survive reconnection; new identities start
-with empty scopes. Private channels additionally require `--private-channel ID` while
-remaining in `--channel ID`. `--sensitive` enables own Artemis participation and
-feedback reads; `--workspace` separately enables preparation under the configured
-workspace root. Neither authorizes submission.
-
-On 24 October 2026, both saved browser-session credentials passed identity
-verification through the actual MCP process. Scoped Artemis exercise listing and
-statement retrieval, plus a bounded Zulip channel search, passed. No participation
-was started, code pushed, message sent, or read flag changed by these checks.
+required. Reconnect through the same selector when a session expires.
+See [Zulip's dispatcher](https://github.com/zulip/zulip/blob/12.0/zerver/lib/rest.py).
+Existing scopes survive reconnection; new identities start with empty scopes.
+Private Zulip channels require `--private-channel ID` as well as `--channel ID`.
+`--sensitive` enables own Artemis participation/feedback reads. It grants no
+website mutation or local execution permission.
 
 Settings live outside the installed package in `TUMMCP/config/preferences.json`.
-The default data directory is beside the legacy `TUMMoodle` directory on each OS.
-Existing Moodle data and its native-store identity are retained in place. New
-campus connections deliberately do not read or migrate native-store secrets;
-reconnect each service once to use local-file storage. The combined MCP process
-uses that storage for all `moodle_*` compatibility tools. The separate Moodle-only
-installer keeps its native-store default.
-Previously imported Artemis Git tokens also need re-importing into the new store;
-browser sign-in does not import them or open the old native store.
-
-New Moodle sessions live under `TUMMoodle/local-session/`; campus credentials live
-under `TUMMCP/credentials/local/`. Each directory has an independent `session.key`.
+Moodle sessions live under `TUMMoodle/local-session/`; Artemis and Zulip credentials
+live under `TUMMCP/credentials/local/`. Each directory has an independent `session.key`.
 Encrypted records and keys have owner-only permissions: 0700 directories / 0600
 keys on POSIX; protected current-user DACLs on Windows through PowerShell. No
-administrator privileges are requested. This avoids Keychain/Secret Service
+administrator privileges are requested. This avoids native credential-store
 prompts but protects less than a native store. A copy of both ciphertext and key
 is sufficient to decrypt a session. Do not share, sync publicly, or package them.
 
 Missing or damaged keys fail closed. Restore the matching key from a private
 backup. To start fresh, stop clients and move the affected **local storage folder**
-to a private backup before reconnecting; this also resets its stored Git tokens.
-Never remove the legacy Moodle directory or downloads to repair a login.
-Native-store records remain available to the older installation for rollback.
+to a private backup before reconnecting. Keep downloaded course materials when
+repairing a login.
 
 Zulip message text is retrieved live and is not persisted. Retrieved excerpts may
-be transmitted to the coding agent's configured AI provider. Moodle's existing
-document cache retains its documented plaintext/expiry behavior.
+be transmitted to the coding agent's configured AI provider. Moodle caches
+documents and extracted text locally in plaintext.
 
 Course nicknames can be mapped in `mappings` using explicit per-service IDs.
 The tools resolve one exact mapping; ambiguity never grants broader access.
@@ -171,75 +149,64 @@ The tools resolve one exact mapping; ambiguity never grants broader access.
 
 `doctor` reads local configuration and checks runtime prerequisites. It does not
 open a browser, contact campus services, decrypt sessions, or read native stores.
-Saved sessions are **Not verified** until checked. Missing optional Git/Docker
-capabilities do not prevent course reads. Client registration is distinguished
+Saved sessions are **Not verified** until checked. Git and Docker are not
+prerequisites. Client registration is distinguished
 from activation; the host must confirm a running MCP connection after setup.
 
 Use `doctor --live` for bounded authenticated identity checks on saved local
-sessions. This reads Moodle's course overview and Artemis/Zulip identity only;
+sessions and optional GitHub CLI authentication. Campus checks read Moodle's
+course overview and Artemis/Zulip identity only;
 it does not broaden content scopes. `doctor --json` emits schema-versioned JSON
 without terminal styling; combine both flags for live automation. Paths appear
 in JSON for troubleshooting. Default diagnostics do not create state folders.
 
-## Assignment workspaces and tests
+## Study workflows
 
-The user requests `artemis_prepare_workspace` with explicit account/course/
-exercise IDs and graded/practice mode. Missing participation returns
-`ACTION_REQUIRED`; preparation never starts it. Offline IDE access must be
-affirmatively enabled. Import an existing participation-scoped Git token locally:
+`read-content` retrieves course information across the three websites. `sync-study`
+uses read-only local status to initialize an explicitly chosen available course or
+reconcile an existing project. Incomplete state is preserved for recovery.
+`prepare-study` creates or extends its local interactive site. See the
+[study guide](study.md) for examples, state structure and helper commands.
 
-```sh
-tum-mcp workspace connect-git ACCOUNT_ID COURSE_ID EXERCISE_ID
-```
-
-The hidden clone URL must match the server-reported participation repository.
-It is sanitized before storage/output. A narrow Git credential helper supplies
-the token only to that HTTPS repository. Clone uses no inherited credential
-helpers, external Git protocols, hooks, submodules, or dependency installers.
-Existing unrelated/dirty work is preserved. Local receipt files contain IDs,
-workspace, mode, branch, and revision, never tokens.
-
-Configure `test_recipes` locally with a unique `name`, exact `account_id`,
-`course_id`, an image pinned as `registry/image@sha256:DIGEST`, an `argv` array,
-`timeout_seconds`, and `verification_level` (`targeted` by default, or `full`
-after reviewing the complete test command). Submission preflight requires a
-passing `full` recipe for the exact content. Review the recipe and obtain its
-image/dependencies as a separate step. The runner uses an already-present image (`--pull=never`), no
-network, no home/keychain/SSH mounts, a read-only container filesystem, dropped
-capabilities, and CPU/memory/process/time/output limits. Only the assignment
-workspace is mounted read/write, with its Git metadata mounted read-only.
-Receipts record exit status, source fingerprints, recipe, image, timestamps,
-and bounded output. A missing engine or recipe fails
-closed. Evidence is encrypted/authenticated outside the assignment directory;
-editing a workspace JSON file cannot fabricate a passing receipt. Ordinary
-host-native testing does not acquire these isolation guarantees.
+One project holds one course. Source revisions, coverage and course knowledge
+avoid unnecessary rereads. Edited files and customized site templates are kept;
+changed sources invalidate dependent units. Study projects, originals and learner
+progress are preserved during package updates/removal.
 
 ## Client and skill setup
 
 `setup --client codex` prepares a local plugin/marketplace entry using the
-portable Agent Plugins schemas. Enable it in
-Codex Plugins, restart, and verify real tool and skill loading. Disable the legacy
-TUM Moodle plugin when switching so duplicate tools/skills are not active.
-The old installation remains available for rollback. Setup reports required UI
-steps and never equates writing files with activation.
+portable Agent Plugins schemas. Enable it in Codex Plugins, restart, and verify
+real tool and skill loading. Setup reports required UI steps and never equates
+writing files with activation.
 
 The Codex adapter uses a contained Node launcher to pin the managed Python in
 isolated mode; portable stdio manifests require a bare or contained executable.
-Disposable-profile checks with Codex CLI 0.164.0 discovered all seven campus
-skills and 36 tools with no discovery error. Claude Code 2.1.304 connected to the
-stdio process. `scripts/verify_campus_clients.py` reproduces those checks without
-running another coding agent or changing real user profiles. After a user restart,
-an active Codex desktop chat also loaded all 36 tools, verified both provider
-identities, and passed scoped Artemis exercise and Zulip message reads.
-Host/model activation trials remain a separate gate.
-
-`setup --client claude` preserves unrelated user configuration, registers the
-local MCP server, and installs the skill pack. Codex's submission invocation
-policy and Claude's `disable-model-invocation` metadata are handled independently.
-Generic clients receive configuration plus optional manual skill export.
-
-`setup --client cursor` writes `~/.cursor/mcp.json`.
-`setup --client antigravity` writes `~/.gemini/config/mcp_config.json`; an existing
+The shipped pack contains five skills: `read-content`, `sync-study`,
+`prepare-study`, `audio-notes` and `publish-study`. Website-specific retrieval
+guidance is loaded from references within read-content. Teaching, schema and design contracts live
+with prepare-study; the renderer and synthetic example ship as reusable assets.
+Audio Notes converts prepared content into category tracks and maintains coverage,
+scripts, voice settings, candidates and archives under the course's `audio/` root.
+Publish Study uses host GitHub CLI authentication to create a private repository
+and a public Pages website after explicit publication consent. It chooses a course
+and semester name, updates the same site after successful study builds, and shows
+the hosted URL alongside the local launcher URL. No tokens or original course
+downloads are uploaded. See [publishing](study.md#publish-a-study-website).
+Old seven-skill, three-site and separate init/update packs are retired only when
+managed copies remain unchanged. Personal overrides are preserved and require a deliberate merge into
+the consolidated workflows before export.
+
+`scripts/verify_campus_clients.py` checks real host discovery in disposable
+profiles without running a model or changing actual user profiles. Host/model
+routing quality is a separate evaluation from structural and discovery checks.
+Claude's invocation metadata follows each workflow's selected policy; automatic
+selection is enabled by default and never grants permission for a mutation.
+
+`setup --client cursor` writes `~/.cursor/mcp.json` and installs all five skills
+under `~/.cursor/skills/`.
+`setup --client antigravity` installs the same skills under `~/.gemini/config/skills/`
+and writes `~/.gemini/config/mcp_config.json`; an existing
 legacy `~/.gemini/antigravity/mcp_config.json` is reused when no current file exists.
 Both merge the `tum` stdio entry and preserve unrelated settings.
 From WSL, append `--host windows` to any client setup command to target its
@@ -253,18 +220,25 @@ in the host after setup; actual host activation is not certified by writing file
 See the official [Cursor MCP documentation](https://cursor.com/docs/mcp) and
 [Antigravity MCP documentation](https://antigravity.google/docs/mcp).
 
-These two adapters install MCP configuration only. Export the workflow skills
-below and install them using the host's documented skill mechanism after review.
-This avoids claiming equivalent invocation controls across clients. No new
-Cursor/Antigravity model-routing or native desktop activation result is claimed.
-`uninstall --client cursor` and `uninstall --client antigravity` remove only an
-unchanged managed entry; sessions and personal work stay intact.
+Both adapters install complete skill bundles, including references and website
+assets. Existing MCP-only registrations gain skills through setup or `tum-mcp update`.
+Ownership receipts track installed files: updates replace only unchanged managed
+files, and uninstall removes only unchanged managed files and the MCP entry.
+An edited managed file blocks that client's update or uninstall for review.
+Unrelated skills, extra user files, sessions and personal work stay intact.
+Without an ownership receipt, uninstall preserves manually installed skills.
+Restart the client and verify that its skills and MCP tools appear; writing files
+does not establish model-routing quality or native desktop activation.
+See the official [Cursor skills guide](https://cursor.com/help/customization/skills)
+and [Antigravity skills guide](https://antigravity.google/docs/skills?app=antigravity-ide).
+
+Manual export remains available for other clients or a separate reviewed copy:
 
 ```sh
 tum-mcp skills list
-tum-mcp skills inspect tum-zulip-research
-tum-mcp skills customize tum-zulip-research
-tum-mcp skills diff tum-zulip-research
+tum-mcp skills inspect read-content
+tum-mcp skills customize read-content
+tum-mcp skills diff read-content
 tum-mcp skills validate
 tum-mcp skills export /path/to/new/export-folder
 ```
@@ -278,28 +252,27 @@ trials, and two review passes have not been demonstrated for this pilot.
 Export refuses symbolic links and
 does not overwrite an existing destination.
 
-The bundled activation corpus has 140 cases (16 development and four held-out
-cases per skill), including explicit/implicit requests, adjacent negatives, and
-missing credentials. `skills evaluate TRIALS.jsonl` scores supplied fresh-session
+The activation corpus covers the reading, study and audio workflows, with
+development and held-out partitions. It covers explicit/implicit requests, unrelated
+negatives, missing credentials and unsupported-action negatives. Old trial
+results must not be reused against the consolidated skill labels. `skills evaluate TRIALS.jsonl` scores supplied fresh-session
 records separately by host/version/model. Each record follows `Trial` in
 `skill_validation.py` and references its retained raw trace by SHA-256. The scorer
 does not launch other agents or certify the supplied traces, summary quality,
 or platform acceptance. Inspect traces and backend effects before approving a
 release; no measured activation accuracy is claimed by the structural checks.
 
-## Release scope
-
-Version 0.5.0 has automated installation, browser transport, storage and MCP
-checks on macOS, Windows, Linux, and both distribution engines on WSL 3.0.3.
-These checks use synthetic pages and credentials. Fresh human SSO/MFA and
-desktop-client activation on every target remain separate manual checks, as do
-host/model skill-selection trials. Remote workflows also need a
-trusted approval/host credential boundary and safe practice verification before
-they can be exposed. Browser sign-in alone does not establish a saved backend connection.
-
-Maintainer checks include the relevant tests, a reviewed tarball inventory,
-integrity checks, and an isolated consumer install. Never publish or stage npm
-packages as a test. Review and authorization of a registry upload are separate
-from a GitHub source push.
-`tum-mcp status` reports registry state as `not_checked`, since it inspects local
-configuration without making registry requests.
+## Verification and release scope
+
+Local source validation, real MCP protocol discovery, installation/migration
+checks and browser study-site QA are separate gates. Model-routing accuracy and
+human SSO/MFA on every desktop are not established by schema tests or generated
+configuration. No measured skill-selection accuracy is claimed.
+
+The existing desktop/WSL CI matrix must pass on the exact pushed revision before
+it is described as verified. Test data and public fixtures are synthetic. Real
+course material, local agent notes and screenshots stay under ignored local paths.
+Maintainer checks include a reviewed tarball inventory, integrity checks and an
+isolated consumer install. Never publish or stage npm packages as a test. Registry
+publication is an explicit maintainer action.
+`tum-mcp status` reports registry state as `not_checked`; it reads local configuration.

package/npm/backend/manifest.json

@@ -1,5 +1,5 @@
 {
-  "wheel": "tum_moodle_integration-0.5.0-py3-none-any.whl",
-  "wheelSha256": "ec23f7335cd579eb96dabb62ee835c8d35c8e17f2900d194162bb6887d878b7e",
-  "requirementsSha256": "af80954b16be4f432ad3cdc56a0354236703a852b3f50206ba688355c723a118"
+  "wheel": "tum_mcp-0.6.1-py3-none-any.whl",
+  "wheelSha256": "59ecf435716e6c0ab68ed9720f2c137b3236f64dd5e962db4c3bf82b76c45ba2",
+  "requirementsSha256": "25f9efa7a4ffb0b97abcfeb9d4706d04808273ab1b35abcfaa1ef0b66e87591b"
 }

package/npm/backend/requirements.txt

@@ -48,7 +48,7 @@ backports-zstd==1.8.0 ; python_full_version < '3.14' \
 beautifulsoup4==4.15.0 \
     --hash=sha256:288e3ca7d54b06f2ac191970bc275c1939cb46d450b255bf6718b04aa37ab4f7 \
     --hash=sha256:d6f88de62e1d4e38ecb1077eb9724cd0eff29d2a08ca16a401e9b9e93f117cf9
-    # via tum-moodle-integration
+    # via tum-mcp
 brotli==1.2.0 ; platform_python_implementation == 'CPython' \
     --hash=sha256:0cf8c3b8ba93d496b2fae778039e2f5ecc7cff99df84df337ca31d8f2252896c \
     --hash=sha256:1b1d6a4efedd53671c793be6dd760fcf2107da3a52331ad9ea429edf0902f27a \
@@ -207,15 +207,15 @@ cryptography==47.0.0 \
     # via
     #   pyjwt
     #   secretstorage
-    #   tum-moodle-integration
+    #   tum-mcp
 defusedxml==0.7.1 \
     --hash=sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69 \
     --hash=sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61
-    # via tum-moodle-integration
+    # via tum-mcp
 filelock==3.32.7 \
     --hash=sha256:37b8a3d9811b0f9aef7e5ec5c71bb320de52df51e6ca9bcd6f5ad81187660da7 \
     --hash=sha256:65ff0d0190ea42038b32bda4b77834fb05be2cad4c5b9b01aa4dfb3614536e52
-    # via tum-moodle-integration
+    # via tum-mcp
 greenlet==3.5.6 \
     --hash=sha256:06c0e933290fba8ffe53ead4ae1b8044b0e9754b75cebf381aa2bc3e50d82fac \
     --hash=sha256:2ab5f42ac6c238eb71770715e6e909ad9a1a92b6c681ccb64cd5a0f07edb953f \
@@ -291,7 +291,7 @@ httpx2==2.15.1 \
     --hash=sha256:ff75485308fbe441e75b1218546e4e78d884df41e1a9741c1f79335ed8fcfef7
     # via
     #   mcp
-    #   tum-moodle-integration
+    #   tum-mcp
 httpx2-jsfetch==1.0 ; sys_platform == 'emscripten' \
     --hash=sha256:70a0e3eabfef7cce5ad9c629f7d01ca05e418f586646f4ddf14782e4c1454c60 \
     --hash=sha256:cb916b707601e69a07721aabc8f3f6659be3a6893bc1ff5c6f9e02241df2da32
@@ -329,7 +329,7 @@ jsonschema==4.26.0 \
     --hash=sha256:d489f15263b8d200f8387e64b4c3a75f06629559fb73deb8fdfb525f2dab50ce
     # via
     #   mcp
-    #   tum-moodle-integration
+    #   tum-mcp
 jsonschema-specifications==2025.9.1 \
     --hash=sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe \
     --hash=sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d
@@ -337,7 +337,11 @@ jsonschema-specifications==2025.9.1 \
 keyring==25.7.0 \
     --hash=sha256:be4a0b195f149690c166e850609a477c532ddbfbaed96a404d4e43f8d5e2689f \
     --hash=sha256:fe01bd85eb3f8fb3dd0405defdeac9a5b4f6f0439edbb3149577f244a2e8245b
-    # via tum-moodle-integration
+    # via tum-mcp
+latex2mathml==3.81.1 \
+    --hash=sha256:c337668441b71c819b6733905a8058ba9a9d767bae11a0c5fdacb3aff31361bd \
+    --hash=sha256:c95add0c0fcdecad2d70567e0643050d5ea1149fb2e98a5d5792fb1c8eea2ed5
+    # via tum-mcp
 markdown-it-py==4.2.0 \
     --hash=sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49 \
     --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a
@@ -345,7 +349,7 @@ markdown-it-py==4.2.0 \
 mcp==2.3.0 \
     --hash=sha256:8b147a50441cf059dc88c684e0aeed3687f0aa0f39c6cde7b90330effd2b34d8 \
     --hash=sha256:dd0c44c089d16453e8ae31a3877a0054d7a2314caaa81f5e0541b9b1734b2377
-    # via tum-moodle-integration
+    # via tum-mcp
 mcp-types==2.3.0 \
     --hash=sha256:968efdbdaedfab06adae40d378a34395f1090c5921d4be3c9cde283aaf76d91d \
     --hash=sha256:d1e46549edb35ee19a94940fcee6d1addd7e589ab7ea92dda83f5d84781fc362
@@ -420,7 +424,7 @@ pillow==12.3.0 \
     --hash=sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5 \
     --hash=sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d \
     --hash=sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198
-    # via tum-moodle-integration
+    # via tum-mcp
 playwright==1.64.0 \
     --hash=sha256:2c14d105548876b15bea5e7eca77bf0d8ff4ba0c607c1ae931067f3d1b010369 \
     --hash=sha256:5a59af1b230b234008524a5d42b613b233d4256f73bc1dd25bf3f11db0c81b75 \
@@ -430,7 +434,7 @@ playwright==1.64.0 \
     --hash=sha256:8de42430e9a7c8b04ec963856d484d36ffd452882318ebad2df3e6fb49a8197a \
     --hash=sha256:97a5c247f1130f3343f097caf3bb1e79358d6b6cfa3550d97ecd721d1905911a \
     --hash=sha256:d76a501c9930b5a097b00e2448cda2200122a1e8e4be762ff535c1b076277737
-    # via tum-moodle-integration
+    # via tum-mcp
 prompt-toolkit==3.0.53 \
     --hash=sha256:01c0891d7f9237d5e339f7d3e42cdae80b7534abb1c7c0e3352efba6231492f2 \
     --hash=sha256:9ec8a0ad96d5c56148b3f914aa79c1564c3fde5d2e6b876e7bc327e353cf8fa6
@@ -457,7 +461,7 @@ psutil==7.2.2 \
     --hash=sha256:ed0cace939114f62738d808fdcecd4c869222507e266e574799e9c0faa17d486 \
     --hash=sha256:eed63d3b4d62449571547b60578c5b2c4bcccc5387148db46e0c2313dad0ee00 \
     --hash=sha256:fd04ef36b4a6d599bbdb225dd1d3f51e00105f6d48a28f006da7f9822f2606d8
-    # via tum-moodle-integration
+    # via tum-mcp
 pycparser==3.11 ; implementation_name != 'PyPy' \
     --hash=sha256:51d5a8ba2be0bbe440b99d2112604c95bbbc3c2748a64260186c541e1729cd80 \
     --hash=sha256:d875f09c3507d00e1aba0eecc6dcadc1352f30fff09dc6bff2f1c2935e97c2bc
@@ -468,7 +472,7 @@ pydantic==2.14.1 \
     # via
     #   mcp
     #   mcp-types
-    #   tum-moodle-integration
+    #   tum-mcp
 pydantic-core==2.50.1 \
     --hash=sha256:0036473f5583e6a60e50b8b21651511564277a3f05cc5dab8cf579f552cd5f6c \
     --hash=sha256:009634b83993777ddcd69cad0ffcace43dabde692109528e35f0fde91e386a8b \
@@ -563,7 +567,7 @@ pyjwt==2.15.1 \
 pypdf==6.21.1 \
     --hash=sha256:2d62c383acd6e0dff0a96322ba8b1135229343b084d73c6f6cfd947fd291afcb \
     --hash=sha256:553e2d42f5bb3bb2a785a7d3de8ef90bb7df74b5413eff5a7b4388007ea9254b
-    # via tum-moodle-integration
+    # via tum-mcp
 pypdfium2==5.14.0 \
     --hash=sha256:09b99c8f0cb427eb17fec13c0862ed598bba34b4843df153f70fff806a2820bc \
     --hash=sha256:11f281613fa22313d9c7ab89947665e84eccf8ebe40e1198a84a88352305648d \
@@ -588,7 +592,7 @@ pypdfium2==5.14.0 \
     --hash=sha256:eb8aeca157808f323e39ea298cc6d6c8e080c192ea2efb1ca81daa0f0ff4d095 \
     --hash=sha256:f1b696e6901e16f114a2ec6332e5e3f8f5033a901614ead28499ab18ca6024f5 \
     --hash=sha256:f6f13bbcc5f4adabc2676e52f662c6cb375de86b314790b0ae08f3ab62eb116a
-    # via tum-moodle-integration
+    # via tum-mcp
 python-multipart==0.0.32 \
     --hash=sha256:be54b7f3fa167bb83e4fcd936b887b708f4e57fe75911c02aebf53efaf8d938e \
     --hash=sha256:ff6d3f776f16878c894e52e107296ffc890e913c611b1a4ec6c44e2821fe2e23
@@ -638,11 +642,11 @@ pyyaml==6.0.3 \
     --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \
     --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \
     --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6
-    # via tum-moodle-integration
+    # via tum-mcp
 questionary==2.1.1 \
     --hash=sha256:3d7e980292bb0107abaa79c68dd3eee3c561b83a0f89ae482860b181c8bd412d \
     --hash=sha256:a51af13f345f1cdea62347589fbb6df3b290306ab8930713bfae4d475a7d4a59
-    # via tum-moodle-integration
+    # via tum-mcp
 referencing==0.37.0 \
     --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231 \
     --hash=sha256:44aefc3142c5b842538163acb373e24cce6632bd54bdb01b21ad5863489f50d8
@@ -653,7 +657,7 @@ rich==15.0.0 \
     --hash=sha256:33bd4ef74232fb73fe9279a257718407f169c09b78a87ad3d296f548e27de0bb \
     --hash=sha256:edd07a4824c6b40189fb7ac9bc4c52536e9780fbbfbddf6f1e2502c31b068c36
     # via
-    #   tum-moodle-integration
+    #   tum-mcp
     #   typer
 rpds-py==2026.9.1 \
     --hash=sha256:00ba2d8c7dd4ee537978ddf4b3fbd712bef2d8751603f7f3146b3f4287768e25 \
@@ -764,7 +768,7 @@ truststore==0.10.5 ; sys_platform != 'emscripten' \
 typer==0.27.3 \
     --hash=sha256:d0396f770a560ab1b0a8504e13b5f254b728cedb05c61cf0359e944e50ce8901 \
     --hash=sha256:e50022f28b82a86313e54501317a1db64bf8f8d036ff8cfe5ca7e47675454aff
-    # via tum-moodle-integration
+    # via tum-mcp
 typing-extensions==4.16.0 \
     --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
     --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5

package/npm/lock.mjs

@@ -0,0 +1,43 @@
+import { randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { mkdir, rename, rm, rmdir, writeFile } from 'node:fs/promises';
+import { hostname } from 'node:os';
+import { join } from 'node:path';
+
+export async function acquireLock(root, name = 'setup') {
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const lock = join(root, `${name}.lock`);
+  const owner = { pid: process.pid, host: hostname(), nonce: randomUUID() };
+  const guard = join(root, `${name}.claim`);
+  try { await mkdir(guard, { mode: 0o700 }); }
+  catch { throw new Error(`Another ${name} is claiming the lock. Retry; an interrupted ${name}.claim needs local review.`); }
+  try {
+    try { await mkdir(lock, { mode: 0o700 }); }
+    catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      let previous;
+      try { previous = JSON.parse(readFileSync(join(lock, 'owner.json'), 'utf8')); }
+      catch { throw new Error(`${name} lock has no readable owner. Confirm no operation is running before removing ${name}.lock.`); }
+      if (!Number.isSafeInteger(previous.pid) || previous.pid <= 0 || previous.host !== hostname()) {
+        throw new Error(`${name} lock belongs to an unknown owner; preserve it for local review.`);
+      }
+      let alive = true;
+      try { process.kill(previous.pid, 0); }
+      catch (failure) { if (failure.code === 'ESRCH') alive = false; }
+      if (alive) throw new Error(`Another ${name} is running; retry when it finishes.`);
+      const abandoned = `${lock}.${randomUUID()}.abandoned`;
+      await rename(lock, abandoned);
+      await rm(abandoned, { recursive: true, force: true });
+      try { await mkdir(lock, { mode: 0o700 }); }
+      catch { throw new Error(`Another ${name} acquired the lock; retry when it finishes.`); }
+    }
+    const temporary = join(lock, `${owner.nonce}.pending`);
+    await writeFile(temporary, JSON.stringify(owner), { mode: 0o600, flag: 'wx' });
+    await rename(temporary, join(lock, 'owner.json'));
+  } finally { await rmdir(guard); }
+  return async () => {
+    const current = JSON.parse(readFileSync(join(lock, 'owner.json'), 'utf8'));
+    if (current.nonce !== owner.nonce) throw new Error(`${name} lock ownership changed; it was preserved.`);
+    await rm(lock, { recursive: true, force: true });
+  };
+}