brightspace-mcp-server 3.12.0 → 3.12.2

package/build/api/paginate.js

@@ -48,6 +48,7 @@ export async function fetchAllItems(apiClient, firstPath, options) {
 }
 /**
  * Every object across every page of a { Objects, Next } endpoint, in order.
+ * A bare array response is taken as the complete list.
  *
  * Next arrives either as a full next-page URL or as a bare bookmark, so the
  * absolute form is reduced to its path and query and anything else is treated
@@ -65,6 +66,11 @@ export async function fetchAllObjects(apiClient, firstPath, options) {
         }
         const response = await apiClient.get(path, options);
         pages += 1;
+        // Some tenants answer a paged route with a bare array: that is the whole list.
+        if (Array.isArray(response)) {
+            objects.push(...response);
+            break;
+        }
         objects.push(...(response?.Objects ?? []));
         const next = response?.Next;
         if (!next)

package/build/auth/auth-runner.js

@@ -53,6 +53,14 @@ const CALL_BUDGET_MS = 55000;
  * from another one) means nobody is approving.
  */
 const ABANDON_MS = MFA_POLL_MS;
+/**
+ * Calls arriving within this long of a batch's first call count as that batch
+ * (issue #212). A client running tool calls in parallel sends them within
+ * milliseconds; a model retrying after reading an answer takes a whole round
+ * trip, and each call is held up to CALL_BUDGET_MS anyway, so a retry always
+ * lands in a fresh batch and gets the number again.
+ */
+const WAVE_MS = 5000;
 /**
  * Milliseconds until a background sign-in counts as abandoned; zero or less
  * means it already is. A caller still waiting keeps it alive outright;
@@ -84,6 +92,7 @@ function mfaPendingFailure(numberMatch) {
 export class AuthProcessError extends AuthError {
     kind;
     numberMatch;
+    duplicate;
     constructor(kind, message, 
     /**
      * Entra number-match digits, when the failure is "mfaPending". Crossed
@@ -91,10 +100,17 @@ export class AuthProcessError extends AuthError {
      * MFA_NUMBER_MARKER below) — already bounded to 1-3 digits at the point
      * it was scraped from the page, so it is safe to surface verbatim.
      */
-    numberMatch) {
+    numberMatch, 
+    /**
+     * Another call in the same parallel batch already carried this exact
+     * challenge to the user (issue #212), so this one should answer briefly
+     * instead of repeating the number and the instructions.
+     */
+    duplicate = false) {
         super(message);
         this.kind = kind;
         this.numberMatch = numberMatch;
+        this.duplicate = duplicate;
         this.name = "AuthProcessError";
     }
 }
@@ -157,20 +173,21 @@ function forwardLines(stream, emit) {
         buffered = "";
     });
 }
-/**
- * Launches the brightspace-auth CLI as a child process to
- * re-authenticate when the current session has expired.
- *
- * The child inherits the parent's resolved environment and working directory,
- * so both processes read the same account configuration and .env file. It
- * runs headless unless D2L_HEADLESS is set explicitly.
- *
- * run() settles as soon as the child reports an MFA challenge (with or
- * without a number to display) rather than waiting for the child to exit —
- * a tool call must not block for the whole approval window. The child keeps
- * running in the background; a later run() call joins that background child
- * instead of spawning a second one.
- */
+function dedupeChallenge(error, wave) {
+    if (!(error instanceof AuthProcessError) || error.kind !== "mfaPending" || error.duplicate)
+        return error;
+    const key = error.numberMatch ?? "";
+    if (!wave.delivered.has(key)) {
+        wave.delivered.add(key);
+        // Once a challenge has gone back to the user, the batch is over: every
+        // call already in it is a sibling, but a call arriving from now on is a
+        // RETRY -- quite possibly because the client hid this very answer -- and
+        // must get the digits in full. This is what keeps #201's guarantee.
+        wave.closed = true;
+        return error;
+    }
+    return new AuthProcessError(error.kind, error.message, error.numberMatch, true);
+}
 export class AuthRunner {
     /**
      * The login this process already started, if one is still running.
@@ -203,6 +220,12 @@ export class AuthRunner {
     waiting = 0;
     /** When the last caller left run(). */
     lastAttendedAt = 0;
+    /**
+     * The current parallel batch and the challenges already handed to one of
+     * its calls (issue #212). The sign-in itself is shared through inFlight and
+     * childDone; this only stops every call in the batch repeating the number.
+     */
+    wave = null;
     scriptPath;
     timeoutMs;
     onProgress;
@@ -232,15 +255,27 @@ export class AuthRunner {
      * the next call to join.
      */
     async run(onChallenge) {
+        // Synchronous, before any await: calls in one tick cannot split a batch.
+        const wave = this.joinWave();
         this.waiting += 1;
         try {
             return await this.attend(onChallenge);
         }
+        catch (error) {
+            throw dedupeChallenge(error, wave);
+        }
         finally {
             this.waiting -= 1;
             this.lastAttendedAt = Date.now();
         }
     }
+    joinWave() {
+        const now = Date.now();
+        if (!this.wave || this.wave.closed || now - this.wave.openedAt > WAVE_MS) {
+            this.wave = { openedAt: now, delivered: new Set(), closed: false };
+        }
+        return this.wave;
+    }
     async attend(onChallenge) {
         const startedAt = Date.now();
         try {
@@ -427,6 +462,7 @@ export class AuthRunner {
                     this.childDone = null;
                     this.pendingChallenge = null;
                     this.challengeSignal = null;
+                    this.wave = null;
                 }
             });
             trackedCompletion.catch(() => { });

package/build/tools/get-assignments.js

@@ -4,7 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
-import { fetchAllItems } from "../api/paginate.js";
+import { fetchAllItems, fetchAllObjects } from "../api/paginate.js";
 import { GetAssignmentsSchema } from "./schemas.js";
 import { toolResponse, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
 import { convertHtmlToMarkdown } from "../utils/html-converter.js";
@@ -110,7 +110,10 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
     // cannot be made until they have answered.
     const [dropboxResult, quizResult, gradebookResult, contentResult] = await Promise.allSettled([
         apiClient.get(apiClient.le(courseId, "/dropbox/folders/"), { ttl: DEFAULT_CACHE_TTLS.assignments }),
-        apiClient.get(apiClient.le(courseId, "/quizzes/"), { ttl: DEFAULT_CACHE_TTLS.assignments }),
+        // Quizzes are paged; a course with many of them spills past page one.
+        fetchAllObjects(apiClient, apiClient.le(courseId, "/quizzes/"), {
+            ttl: DEFAULT_CACHE_TTLS.assignments,
+        }),
         apiClient.get(apiClient.le(courseId, "/grades/"), {
             ttl: DEFAULT_CACHE_TTLS.assignments,
         }),
@@ -263,11 +266,7 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
     // forbidden or unavailable, so a failed list starts from an empty set.
     let quizzes = [];
     if (quizResult.status === "fulfilled") {
-        const quizResponse = quizResult.value;
-        // D2L quizzes API returns paged result { Objects: [...] } or a plain array
-        quizzes = Array.isArray(quizResponse)
-            ? quizResponse
-            : quizResponse?.Objects ?? [];
+        quizzes = quizResult.value;
     }
     else {
         log("DEBUG", `Failed to fetch quizzes for course ${courseId}`, quizResult.reason);

package/build/tools/get-my-grades.js

@@ -4,7 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
-import { fetchAllItems } from "../api/paginate.js";
+import { fetchAllItems, fetchAllObjects } from "../api/paginate.js";
 import { GetMyGradesSchema, } from "./schemas.js";
 import { toolResponse, sanitizeError, errorResponse, isAuthUnavailable, authPendingNotice, } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
@@ -27,8 +27,10 @@ const QUIZ_FEEDBACK_NOTE = "The gradebook has no comment for this item, but it i
  */
 async function fetchQuizzes(apiClient, courseId) {
     try {
-        const raw = await apiClient.get(apiClient.le(courseId, "/quizzes/"), { ttl: DEFAULT_CACHE_TTLS.assignments });
-        return Array.isArray(raw) ? raw : raw?.Objects ?? [];
+        // Quizzes are paged; a course with many of them spills past page one.
+        return await fetchAllObjects(apiClient, apiClient.le(courseId, "/quizzes/"), {
+            ttl: DEFAULT_CACHE_TTLS.assignments,
+        });
     }
     catch (error) {
         log("DEBUG", `get_my_grades: quiz list unavailable for course ${courseId}`, error);

package/build/tools/get-upcoming-due-dates.js

@@ -4,6 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
+import { fetchAllObjects } from "../api/paginate.js";
 import { GetUpcomingDueDatesSchema, } from "./schemas.js";
 import { toolResponse, toolResponseWithNotice, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
@@ -78,7 +79,10 @@ function calendarItems(events, items) {
 async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
     const [dropboxResult, quizResult, discussionResult, calendarResult] = await Promise.allSettled([
         apiClient.get(apiClient.le(course.id, "/dropbox/folders/"), { ttl: DEFAULT_CACHE_TTLS.assignments }),
-        apiClient.get(apiClient.le(course.id, "/quizzes/"), { ttl: DEFAULT_CACHE_TTLS.assignments }),
+        // Quizzes are paged; a course with many of them spills past page one.
+        fetchAllObjects(apiClient, apiClient.le(course.id, "/quizzes/"), {
+            ttl: DEFAULT_CACHE_TTLS.assignments,
+        }),
         fetchDiscussionDueTopics(apiClient, course.id),
         fetchCourseCalendarEvents(apiClient, baseUrl, course, from, to),
     ]);
@@ -117,7 +121,7 @@ async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
         log("DEBUG", `get_upcoming_due_dates: failed to fetch dropbox folders for course ${course.id}`, dropboxResult.reason);
     }
     if (quizResult.status === "fulfilled") {
-        for (const quiz of unwrapList(quizResult.value)) {
+        for (const quiz of quizResult.value) {
             if (quiz.IsActive === false)
                 continue;
             // Many instructors set only an End Date, which is the effective deadline.

package/build/tools/tool-helpers.js

@@ -122,7 +122,14 @@ const AUTH_FAILURE_GUIDANCE = {
  * auth-runner.ts MFA_NUMBER_MARKER) — a bounded, pre-validated value, not
  * arbitrary child output, so it is safe to interpolate here.
  */
+const MFA_ALREADY_REPORTED = "Brightspace sign-in is already in progress; another call in this batch has the number to " +
+    "approve. Retry this call once the sign-in completes.";
 function authFailureMessage(error) {
+    // Another call in this parallel batch already carries the number and the
+    // instructions (issue #212). Repeating them in every response made a batch
+    // unreadable; one short line is enough for this call.
+    if (error.kind === "mfaPending" && error.duplicate)
+        return MFA_ALREADY_REPORTED;
     if (error.kind === "mfaPending" && error.numberMatch) {
         return `Open Microsoft Authenticator and enter ${error.numberMatch} within 5 minutes. ` +
             "Tell the user that number, then call this tool again right away without waiting for them " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.12.0",
+  "version": "3.12.2",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",