brightspace-mcp-server 3.10.15 → 3.10.16

package/README.md

@@ -106,7 +106,7 @@ All optional, set in your AI app's MCP `env` config or your shell. The full list
 
 ## When it asks you to sign in
 
-There's no separate login — asking a question signs you in, and it stays signed in on its own most days. When your school wants two-factor again, the number to approve shows up right in the answer; approve it on your phone and ask again. If your AI client shows tool progress messages, the number appears while the question is still running instead, and approving within 45 seconds (less if sign-in was slow to reach two-factor) finishes the original answer without asking again. If it ever gets stuck, run this in a terminal:
+There's no separate login — asking a question signs you in, and it stays signed in on its own most days. When your school wants two-factor again, the number to approve shows up right in the answer; approve it on your phone and the assistant keeps checking on its own — each check waits up to 45 seconds and the original question completes as soon as the sign-in does, without you having to say you've approved it. If your AI client shows tool progress messages, the number appears while the question is still running instead. If it ever gets stuck, run this in a terminal:
 
 ```bash
 npx -y brightspace-mcp-server@latest auth

package/build/auth/auth-runner.js

@@ -21,18 +21,13 @@ import { devActivity } from "../utils/dev-activity.js";
 const AUTH_TIMEOUT_MS = 8 * 60 * 1000;
 const KILL_GRACE_MS = 5000;
 /**
- * How long a caller that joins a background child already reported as
- * mfaPending waits for it before re-answering with the same challenge.
- * Long enough for an already-approved login to finish its next ~2s poll and
- * mint a token; short enough that a not-yet-approved one still answers
- * within this tool call instead of blocking for the rest of the 5-minute
- * approval window.
- */
-const JOIN_GRACE_MS = 5000;
-/**
- * How long a caller that can be told the challenge mid-call (see run()'s
- * onChallenge) keeps waiting for the background sign-in after the challenge
- * appears: long enough to find a phone and approve.
+ * How long a caller keeps waiting for the background sign-in once the
+ * challenge is known: long enough to find a phone and approve. Applies both
+ * to a caller told the challenge mid-call (see run()'s onChallenge) and to a
+ * retry that joins the background child after an early answer. The retry
+ * used to wait only 5 s, so on clients that send no progress token (Claude
+ * Desktop) every retry re-answered "enter the number" and the model asked
+ * the user to confirm by hand instead of the server polling for the approval.
  */
 const MFA_POLL_MS = 45000;
 /**
@@ -182,18 +177,20 @@ export class AuthRunner {
      * Authenticate, joining the login this process already started if there is
      * one. Returns true on success and throws a useful error on failure.
      *
-     * Without onChallenge, an MFA challenge answers the caller at once with an
-     * mfaPending error. With it, the caller is handed the challenge (the
-     * number to enter, if any) and keeps waiting on the background sign-in for
-     * up to MFA_POLL_MS, and never past CALL_BUDGET_MS from the call, so an
-     * approval within that window completes the caller's original request;
-     * past it, the caller gets the same mfaPending answer it would have had up
-     * front.
+     * Without onChallenge, a NEW sign-in answers the caller at once when an MFA
+     * challenge appears (an mfaPending error carrying the number to enter: the
+     * user cannot see it any other way), and the next call joins the background
+     * sign-in and polls it for up to MFA_POLL_MS, never past CALL_BUDGET_MS from
+     * that call. With onChallenge, the caller is handed the challenge mid-call
+     * and the first call itself keeps waiting the same way. Either way an
+     * approval within the window completes the caller's original request; past
+     * it, the caller gets the same mfaPending answer again and is expected to
+     * call once more.
      */
     async run(onChallenge) {
         const startedAt = Date.now();
         try {
-            return await this.runOnce();
+            return await this.runOnce(startedAt);
         }
         catch (error) {
             const childDone = this.childDone;
@@ -209,7 +206,7 @@ export class AuthRunner {
             return this.awaitBackgroundChild(childDone, windowMs);
         }
     }
-    runOnce() {
+    runOnce(startedAt) {
         if (this.inFlight) {
             log("DEBUG", "Joining the authentication already in flight");
             return this.inFlight;
@@ -220,7 +217,7 @@ export class AuthRunner {
         // cross-process lock and return "busy".
         if (this.childDone) {
             log("DEBUG", "Joining the background sign-in still running from an earlier call");
-            return this.joinBackgroundChild(this.childDone);
+            return this.joinBackgroundChild(this.childDone, startedAt);
         }
         // The latch is released by the flow that owns it, as it settles, so a
         // failed login is never replayed: the tool call after a declined MFA
@@ -237,23 +234,23 @@ export class AuthRunner {
     /**
      * Join a background child from an earlier early-answered call instead of
      * spawning a new one. A joiner must not simply await childDone: that
-     * blocks for whatever is left of the 5-minute approval window, exactly the
-     * problem run() otherwise fixes, since the caller usually retries right
-     * after reading "call this tool again" and well before actually approving.
+     * blocks for whatever is left of the 5-minute approval window, past the
+     * client's request timeout.
      *
      * If no challenge has been reported yet (the child hasn't reached MFA),
      * wait for one — or for the child to finish on its own. Once a challenge
-     * is known, race the child against a short grace window: fast enough for
-     * an already-approved login to land, short enough to re-answer with the
-     * same challenge rather than block.
+     * is known, poll the child for the rest of this call's budget: the user
+     * read the number from the previous answer and is approving right now, so
+     * this is the call that should carry the result. A still-unapproved
+     * sign-in re-answers with the latest challenge and the caller tries again.
      */
-    async joinBackgroundChild(childDone) {
+    async joinBackgroundChild(childDone, startedAt) {
         if (!this.pendingChallenge && this.challengeSignal) {
             await Promise.race([childDone.catch(() => { }), this.challengeSignal]);
         }
         if (!this.pendingChallenge)
             return childDone;
-        return this.awaitBackgroundChild(childDone, JOIN_GRACE_MS);
+        return this.awaitBackgroundChild(childDone, Math.max(0, pollWindowMs(Date.now() - startedAt)));
     }
     /**
      * Race a background child already past its MFA challenge against a wait

package/build/tools/tool-helpers.js

@@ -98,8 +98,10 @@ const AUTH_FAILURE_GUIDANCE = {
         `Run \`${AUTH_COMMAND}\` in a terminal (from your home folder) to complete it with the number visible.`,
     failed: `The sign-in did not complete. Run \`${AUTH_COMMAND}\` in a terminal (from your home folder) to see why, ` +
         "or `brightspace-setup` if your saved school or username is wrong.",
-    mfaPending: "Approve the sign-in request on your phone (Microsoft Authenticator or Duo), " +
-        "then call this tool again — the sign-in is finishing in the background.",
+    mfaPending: "Approve the sign-in request on your phone (Microsoft Authenticator or Duo). " +
+        "Tell the user that, then call this tool again right away without waiting for them to " +
+        "confirm: each call waits up to 45 seconds for the approval and returns the result as soon " +
+        "as the sign-in completes. Keep calling until it succeeds or reports a different error.",
 };
 /**
  * mfaPending is the one kind whose guidance is partly dynamic: `numberMatch`
@@ -110,8 +112,10 @@ const AUTH_FAILURE_GUIDANCE = {
  */
 function authFailureMessage(error) {
     if (error.kind === "mfaPending" && error.numberMatch) {
-        return `Open Microsoft Authenticator and enter ${error.numberMatch} within 5 minutes, ` +
-            "then call this tool again — the sign-in is finishing in the background.";
+        return `Open Microsoft Authenticator and enter ${error.numberMatch} within 5 minutes. ` +
+            "Tell the user that number, then call this tool again right away without waiting for them " +
+            "to confirm: each call waits up to 45 seconds for the approval and returns the result as " +
+            "soon as the sign-in completes. Keep calling until it succeeds or reports a different error.";
     }
     return AUTH_FAILURE_GUIDANCE[error.kind];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.10.15",
+  "version": "3.10.16",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",