brightspace-mcp-server 3.13.10 → 3.13.12

package/README.md

@@ -77,6 +77,7 @@ School-specific quirks: [docs/sign-in.md](docs/sign-in.md#per-school-notes).
 | Lecture videos | "What did the professor say about pinch-off in Tuesday's recording?" (Kaltura, including BoilerCast LTI links, and YouTube) |
 | Calendar | "When is my midterm?" · "Is lab cancelled on Thursday?" |
 | For instructors and TAs | "Which students haven't submitted Lab 4 yet?" · "What feedback did I leave on this student's homework?" · "Download that student's submitted PDF" (students see a clear "instructor access required" note) |
+| Signing out | "Sign me out of Brightspace" (your AI app may ask you to confirm first; details under [When it asks you to sign in](#when-it-asks-you-to-sign-in)) |
 
 ## Prompts
 
@@ -124,7 +125,7 @@ sits beside your password, so on **this** computer your two factors become one.
 anyone who only has your password, and it changes nothing for your other devices. Full enrollment
 steps: [docs/sign-in.md](docs/sign-in.md#answering-code-challenges-without-your-phone).
 
-**To sign out early** (on a shared computer, say), run `npx -y brightspace-mcp-server@latest auth --logout`. It deletes this computer's saved Brightspace session, so the next question does a full sign-in. Your saved password, authenticator key, and settings are kept. An AI app that is already running can keep answering until its current access token expires; restart the app to drop it right away. It only clears this computer; it does not sign you out of Microsoft or Brightspace anywhere else. If a sign-in is in progress, it refuses and deletes nothing.
+**To sign out early** (on a shared computer, say), just ask your AI app to sign you out of Brightspace, or run `npx -y brightspace-mcp-server@latest auth --logout` in a terminal. It deletes this computer's saved Brightspace session, so the next question does a full sign-in. Your saved password, authenticator key, and settings are kept, so with a saved authenticator key that sign-in can finish without you; on a shared computer, also delete the saved `brightspace-mcp-server` entries from your computer's password store (Keychain Access on a Mac, Credential Manager on Windows). Other AI apps open on this computer are signed out too and will ask you to sign in on their next question. (An app you opened before updating may keep answering for up to an hour; quit and reopen it to sign it out right away.) It only clears this computer; it does not sign you out of Microsoft or Brightspace anywhere else. If a sign-in is in progress, it refuses and deletes nothing.
 
 How often you're asked is up to your school, not this tool. Everything else about sign-in — Duo, authenticator codes, visible-browser mode, and running without a browser at all (Docker, WSL, hardware keys) — is in [docs/sign-in.md](docs/sign-in.md).
 

package/build/api/client.js

@@ -132,6 +132,13 @@ export class D2LApiClient {
      * Adapted from JhostinAleck/brightspace-mcp (MIT) — RequestCoalescer.ts.
      */
     pendingGets = new Map();
+    /**
+     * Bumped by clearCache(). A GET remembers the value it started under and
+     * stores its result only if it is unchanged, so a read begun with the old
+     * session cannot refill a cache that was cleared (sign-out) while it was in
+     * flight.
+     */
+    cacheGeneration = 0;
     statsData = {
         statusClasses: { "2xx": 0, "401": 0, "403": 0, "404": 0, "429": 0, "5xx": 0, other: 0 },
         networkErrors: 0,
@@ -258,6 +265,13 @@ export class D2LApiClient {
         // ten minutes of due dates to get_upcoming_due_dates. Trusting the
         // surviving entry served the longer caller's staleness to the shorter one.
         if (options?.ttl) {
+            // The saved session may have been deleted by another process (logout),
+            // or replaced by a different account's. A signed-out server must not
+            // answer from memory, so drop every cached response and let this read
+            // take the normal path. Only asked when something is cached, so a cold
+            // cache costs nothing.
+            if (this.cache.size > 0 && await this.tokenManager.sessionChanged?.())
+                this.clearCache();
             const age = this.cache.ageOf(path);
             if (age !== undefined && age <= options.ttl) {
                 log("DEBUG", `Cache hit: ${path}`);
@@ -275,10 +289,11 @@ export class D2LApiClient {
             log("DEBUG", `Coalescing GET onto an in-flight request: ${path}`);
             return pending;
         }
+        const generation = this.cacheGeneration;
         const inFlight = (async () => {
             const resolved = await this.resolvePath(path);
             const data = await this.withAuthentication(resolved, token => this.makeRequest(resolved, token));
-            if (options?.ttl) {
+            if (options?.ttl && generation === this.cacheGeneration) {
                 this.cache.set(path, data, options.ttl);
                 log("DEBUG", `Cached response for ${path} (TTL: ${options.ttl}ms)`);
             }
@@ -633,9 +648,13 @@ export class D2LApiClient {
         return `/d2l/api/le/${LE_VERSION}${path}`;
     }
     /**
-     * Clear all cached responses.
+     * Clear all cached responses, and stop later callers joining GETs already
+     * in flight (they began under the session being discarded; those callers
+     * still get their own answer, but it is not remembered).
      */
     clearCache() {
+        this.cacheGeneration++;
+        this.pendingGets.clear();
         this.cache.clear();
         log("DEBUG", "Cache cleared");
     }

package/build/auth/auth-runner.js

@@ -322,6 +322,16 @@ export class AuthRunner {
         this.onProgress = options.onProgress;
         this.sessionDir = options.sessionDir;
     }
+    /**
+     * Whether this process has a sign-in child running: true from the moment it
+     * is spawned (before the child has taken the cross-process sign-in lock, so
+     * a lock check alone would miss it) until the child exits, even after the
+     * caller that started it was answered early with an MFA challenge. Read-only;
+     * sign_out uses it to refuse to delete a session a sign-in is about to write.
+     */
+    busy() {
+        return this.inFlight !== null || this.childDone !== null;
+    }
     /**
      * Authenticate, joining the login this process already started if there is
      * one. Returns true on success and throws a useful error on failure.

package/build/auth/logout.js

@@ -20,7 +20,7 @@ import { AUTH_COMMAND } from "../utils/commands.js";
 import { resolveSessionLocation } from "../utils/config.js";
 /** Browser state files other than the session token itself, in the order they are deleted. */
 const BROWSER_STATE_FILES = [BROWSER_STATE_FILE, LEGACY_BROWSER_STATE_FILE, MICROSOFT_SESSION_FILE];
-class RemoveError extends Error {
+export class RemoveError extends Error {
     file;
     constructor(file, cause) {
         super(`Could not remove ${file}: ${cause instanceof Error ? cause.message : String(cause)}`);
@@ -39,6 +39,18 @@ async function removeIfPresent(file) {
         throw new RemoveError(path.basename(file), error);
     }
 }
+/** SessionStore.remove() throws SessionStoreError; report it like every other file that would not delete. */
+async function removeSessionFile(sessionDir) {
+    try {
+        return await new SessionStore(sessionDir).remove();
+    }
+    catch (error) {
+        // A session write that holds its lock too long is still "in progress", not a file that won't delete.
+        if (error instanceof AuthenticationInProgressError)
+            throw error;
+        throw new RemoveError(SESSION_FILE, error);
+    }
+}
 /**
  * Delete the saved session files in one account's session directory.
  *
@@ -67,7 +79,7 @@ export async function clearSavedSession(sessionDir) {
     const release = await acquireProcessLock(authLockPath(sessionDir), { mode: "exclusive" });
     try {
         const removed = [];
-        if (await new SessionStore(sessionDir).remove())
+        if (await removeSessionFile(sessionDir))
             removed.push(SESSION_FILE);
         for (const name of BROWSER_STATE_FILES) {
             if (await removeIfPresent(path.join(sessionDir, name)))
@@ -80,7 +92,7 @@ export async function clearSavedSession(sessionDir) {
     }
 }
 const KEPT = "Kept: your saved password, config.json, and any authenticator or credential-store entries.";
-const MEMORY_NOTE = "A running Brightspace MCP server may still hold an access token in memory until it expires. Restart your AI client to drop it right away.";
+const MEMORY_NOTE = "Other Brightspace apps open on this computer sign out on their next request. One you opened before updating may keep answering for up to an hour; quit and reopen it to sign it out right away.";
 const LOCAL_ONLY = "This only clears files on this computer. It does not sign you out of Microsoft or Brightspace on their servers.";
 /**
  * The `auth --logout` command. Resolves to the process exit code: 0 when the

package/build/auth/session-store.js

@@ -164,6 +164,29 @@ export class SessionStore {
             this.storeError("save", error);
         }
     }
+    /**
+     * A cheap identity for the saved session file, so a running server can tell
+     * "same file" from "signed out" from "signed out and signed in again". A
+     * single stat: nothing is read or decrypted and no lock is taken, so it is
+     * cheap enough to ask before every request.
+     *
+     * - `null`: the file definitely does not exist (ENOENT). Signed out.
+     * - a string: the file exists; it changes whenever the file is replaced or
+     *   rewritten (inode, size, and the modified, changed and birth times in
+     *   nanoseconds; Windows may report inode 0, which the times and size still
+     *   distinguish).
+     * - `undefined`: the stat failed for any other reason. An unreadable
+     *   directory is not evidence of a sign-out, so callers keep what they have.
+     */
+    async fingerprint() {
+        try {
+            const stat = await fs.stat(this.sessionFilePath, { bigint: true });
+            return `${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}:${stat.birthtimeNs}`;
+        }
+        catch (error) {
+            return error.code === "ENOENT" ? null : undefined;
+        }
+    }
     /** Missing files return null. Damaged or inaccessible secrets fail without MFA. */
     async load() {
         try {

package/build/auth/token-manager.js

@@ -30,6 +30,21 @@ export class TokenManager {
     /** Single in-flight mint, so concurrent callers share one request. */
     mintInFlight = null;
     rejectedAccessToken = null;
+    /**
+     * The saved session this process last read or wrote, as the account it
+     * belongs to. Kept even while cachedToken is null (an unusable token on
+     * disk), so a later sign-in can still be compared with the account that
+     * the in-memory state, and the API client's response cache, were built for.
+     * Null once the session is known to be gone.
+     */
+    identityToken = null;
+    /** SessionStore.fingerprint() of the file when identityToken was read or written. */
+    observedFingerprint;
+    /**
+     * Set when the session was signed out or replaced by a different account
+     * since sessionChanged() last answered. Errs toward true.
+     */
+    sessionReplaced = false;
     constructor(sessionDirOrOptions) {
         const options = typeof sessionDirOrOptions === "string" || sessionDirOrOptions === undefined
             ? { sessionDir: sessionDirOrOptions }
@@ -64,13 +79,20 @@ export class TokenManager {
             }
             return token;
         }
-        // Check memory cache first
+        // Check memory cache first, after asking whether the saved session is
+        // still the one this process remembers. Another process may have signed
+        // out (deleted it), or signed in again, since this token was cached; when
+        // it has, the memory is dropped or refreshed from disk here. Skipped when
+        // nothing is remembered, so a cold start costs no extra stat.
+        await this.syncWithDisk();
         if (this.cachedToken && this.isUsable(this.cachedToken)) {
             log("DEBUG", "Returning cached token");
             return this.cachedToken;
         }
         // Try loading from disk
         const storedToken = await this.sessionStore.load();
+        if (storedToken)
+            await this.observe(storedToken);
         if (storedToken && this.isUsable(storedToken)) {
             log("DEBUG", "Loaded valid token from session store");
             this.cachedToken = storedToken;
@@ -89,6 +111,120 @@ export class TokenManager {
         log("DEBUG", "No valid token available");
         return null;
     }
+    /**
+     * Whether the saved session was signed out or replaced by a different
+     * account since this was last asked, for example by `brightspace-auth
+     * --logout` or the sign_out tool running in another process, or a new
+     * sign-in as someone else. When it was, anything built under the old
+     * session (the API client's response cache) must not be trusted. Costs one
+     * stat while the file is unchanged.
+     *
+     * True when the file is missing, and when a reload shows a different
+     * account than the one remembered. Names are compared when both sides have
+     * one, otherwise the session cookie; with neither, the answer is true,
+     * because when unsure the safe move is to clear. The same account's token
+     * re-minted by another process (hourly) is not a change, so it does not
+     * wipe a cache that is still valid. The answer is true once per change.
+     * Always false for D2L_ACCESS_TOKEN / D2L_SESSION_COOKIE, which have no
+     * saved session. A failed stat answers false; a replaced file this process
+     * cannot read answers true (the in-memory token is still served, but cached
+     * responses are not trusted until the file reads again).
+     */
+    async sessionChanged() {
+        if (this.envAccessToken || this.envSessionCookie)
+            return false;
+        await this.syncWithDisk();
+        const changed = this.sessionReplaced;
+        this.sessionReplaced = false;
+        return changed;
+    }
+    /**
+     * Drop everything remembered about the saved session without touching any
+     * file: the cached token, a remembered rejection and the recorded file
+     * identity. The next getToken() reads the disk afresh. Call it right after
+     * deleting the session files (the sign_out tool does), so this process stops
+     * acting signed in even when another app has already signed in again and
+     * recreated the file, which a plain existence check could not tell apart.
+     * Also makes the next sessionChanged() answer true, so cached API responses
+     * are not served either.
+     */
+    forgetSession() {
+        this.cachedToken = null;
+        this.rejectedAccessToken = null;
+        this.identityToken = null;
+        this.observedFingerprint = undefined;
+        this.sessionReplaced = true;
+    }
+    /**
+     * Compare the saved file with what this process last saw of it, and bring
+     * memory in line: file gone, forget everything; file replaced or rewritten,
+     * reload it and adopt it (flagging a different account). A fingerprint
+     * that cannot be determined, or an unreadable replacement, keeps the
+     * current state, with an unreadable replacement flagged as changed.
+     * Does nothing, and costs nothing, when nothing is remembered.
+     */
+    async syncWithDisk() {
+        if (!this.identityToken && !this.rejectedAccessToken)
+            return;
+        const fingerprint = await this.sessionStore.fingerprint?.();
+        if (fingerprint === null) {
+            log("DEBUG", "The saved session is gone; dropping the in-memory token");
+            this.forgetSession();
+            return;
+        }
+        if (typeof fingerprint !== "string" || !this.identityToken || fingerprint === this.observedFingerprint)
+            return;
+        log("DEBUG", "The saved session changed on disk; reloading it");
+        let loaded;
+        try {
+            loaded = await this.sessionStore.load();
+        }
+        catch (error) {
+            // Cannot tell whose session this is. Keep serving the token in memory,
+            // do not record the fingerprint (so the next call tries again), and
+            // make sure cached responses are not trusted.
+            log("WARN", "The saved session changed but could not be read", error);
+            this.sessionReplaced = true;
+            return;
+        }
+        if (!loaded) {
+            this.forgetSession();
+            return;
+        }
+        this.adopt(loaded, fingerprint);
+        this.cachedToken = this.isUsable(loaded) ? loaded : null;
+    }
+    /**
+     * Remember `token` as the session now on disk. `fingerprint` is the file's
+     * identity from a stat taken before it was read; without one, it is taken
+     * now, after the read or write that produced `token`. If another process
+     * rewrote the file in the instant between that read or write and the stat,
+     * this records their file's identity against our token, so the change goes
+     * unnoticed until the next rewrite. That is acceptable: the token held is
+     * itself valid, and the window is microseconds wide.
+     */
+    adopt(token, fingerprint) {
+        if (this.identityToken && !this.sameAccount(this.identityToken, token))
+            this.sessionReplaced = true;
+        this.identityToken = token;
+        this.observedFingerprint = fingerprint ?? undefined;
+    }
+    async observe(token) {
+        this.adopt(token, await this.sessionStore.fingerprint?.());
+    }
+    /**
+     * Whether two sessions belong to the same account on the same tenant.
+     * Unknown is not the same: with no name on both sides and no shared cookie,
+     * this answers false.
+     */
+    sameAccount(a, b) {
+        if (a.tenantOrigin !== b.tenantOrigin)
+            return false;
+        if (a.uniqueName !== undefined && b.uniqueName !== undefined) {
+            return a.uniqueName.toLowerCase() === b.uniqueName.toLowerCase();
+        }
+        return a.cookieHeader !== undefined && a.cookieHeader === b.cookieHeader;
+    }
     /**
      * Build the token for D2L_ACCESS_TOKEN or D2L_SESSION_COOKIE;
      * D2L_ACCESS_TOKEN wins when both are set. expiresAt is pushed far into the
@@ -163,7 +299,15 @@ export class TokenManager {
         // The auth CLI or another MCP process can finish a login while HTTP minting
         // is in flight. Its newer session wins over either result of this request.
         const current = await this.sessionStore.load();
-        if (current && !this.sameToken(current, stale)) {
+        if (!current) {
+            // Signed out while the mint was in flight. Saving a token now would
+            // quietly undo that, so drop everything and let the caller sign in.
+            log("DEBUG", "The saved session was removed during the refresh");
+            this.forgetSession();
+            return null;
+        }
+        if (!this.sameToken(current, stale)) {
+            await this.observe(current);
             this.cachedToken = current;
             if (this.isUsable(current))
                 return current;
@@ -187,6 +331,7 @@ export class TokenManager {
             };
             if (!await this.sessionStore.saveIfCurrent(token, stale))
                 return this.afterConcurrentChange();
+            await this.observe(token);
             this.cachedToken = token;
             this.rejectedAccessToken = null;
             log("INFO", "Minted a fresh access token from the session cookie");
@@ -197,6 +342,7 @@ export class TokenManager {
             if (!await this.sessionStore.clearIfCurrent(stale))
                 return this.afterConcurrentChange();
             this.cachedToken = null;
+            this.observedFingerprint = undefined;
             return null;
         }
         throw new TokenRefreshError(result.detail ?? "unexpected token service response");
@@ -206,6 +352,7 @@ export class TokenManager {
      */
     async setToken(token) {
         await this.sessionStore.save(token);
+        await this.observe(token);
         this.cachedToken = token;
         this.rejectedAccessToken = null;
         log("DEBUG", "Token cached and persisted");
@@ -215,6 +362,9 @@ export class TokenManager {
      */
     async clearToken() {
         this.cachedToken = null;
+        this.identityToken = null;
+        this.observedFingerprint = undefined;
+        this.sessionReplaced = true;
         await this.sessionStore.clear();
         log("DEBUG", "Token cleared from memory and disk");
     }
@@ -229,9 +379,17 @@ export class TokenManager {
             a.cookieHeader === b.cookieHeader && a.csrfToken === b.csrfToken && a.tenantOrigin === b.tenantOrigin;
     }
     async afterConcurrentChange() {
-        this.cachedToken = await this.sessionStore.load();
-        if (this.cachedToken && this.isUsable(this.cachedToken))
-            return this.cachedToken;
+        const loaded = await this.sessionStore.load();
+        if (!loaded) {
+            // Nothing is saved any more: the user signed out. That is not a refresh
+            // failure; the caller proceeds to the ordinary sign-in.
+            this.forgetSession();
+            return null;
+        }
+        await this.observe(loaded);
+        this.cachedToken = loaded;
+        if (this.isUsable(loaded))
+            return loaded;
         throw new TokenRefreshError("saved authentication changed during refresh");
     }
     /**

package/build/index.js

@@ -18,7 +18,7 @@ import { configureDevActivity, trackToolActivity } from "./utils/dev-activity.js
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
-import { registerGetMyCourses, registerGetUpcomingDueDates, registerGetCalendarEvents, registerGetMyGrades, registerGetAnnouncements, registerGetAssignments, registerGetAssignmentRubric, registerGetAssignmentFiles, registerGetAnnouncementFiles, registerGetCourseContent, registerDownloadFile, registerGetClasslistEmails, registerGetRoster, registerGetMyGroups, registerGetSyllabus, registerGetDiscussions, registerGetVideoTranscript, registerGetServerInfo, registerSearchCourse, registerGetDropboxFolders, registerGetDropboxSubmissions, registerGetDropboxUserSubmissions, registerGetDropboxFeedback, registerGetRubricsForObject, registerDownloadDropboxSubmissionFile, relayMfaChallenges, currentMfaAnnouncer, } from "./tools/index.js";
+import { registerGetMyCourses, registerGetUpcomingDueDates, registerGetCalendarEvents, registerGetMyGrades, registerGetAnnouncements, registerGetAssignments, registerGetAssignmentRubric, registerGetAssignmentFiles, registerGetAnnouncementFiles, registerGetCourseContent, registerDownloadFile, registerGetClasslistEmails, registerGetRoster, registerGetMyGroups, registerGetSyllabus, registerGetDiscussions, registerGetVideoTranscript, registerGetServerInfo, registerSearchCourse, registerSignOut, registerGetDropboxFolders, registerGetDropboxSubmissions, registerGetDropboxUserSubmissions, registerGetDropboxFeedback, registerGetRubricsForObject, registerDownloadDropboxSubmissionFile, relayMfaChallenges, currentMfaAnnouncer, } from "./tools/index.js";
 import { registerWeeklyBriefingPrompt, registerGradeAuditPrompt, registerStudyPlannerPrompt, registerCourseSummaryPrompt, } from "./prompts/index.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -145,6 +145,7 @@ else {
             registerGetVideoTranscript(server, apiClient);
             registerGetServerInfo(server, config, PKG_VERSION, apiClient);
             registerSearchCourse(server, apiClient);
+            registerSignOut(server, config, apiClient, tokenManager, authRunner);
             // Instructor / TA dropbox tools (read-only) — 403 for a student account.
             registerGetDropboxFolders(server, apiClient);
             registerGetDropboxSubmissions(server, apiClient);
@@ -152,7 +153,7 @@ else {
             registerGetDropboxFeedback(server, apiClient);
             registerGetRubricsForObject(server, apiClient);
             registerDownloadDropboxSubmissionFile(server, apiClient);
-            log("DEBUG", "MCP tools registered (25 tools)");
+            log("DEBUG", "MCP tools registered (26 tools)");
             // Register MCP prompts — surfaced in clients (e.g. Claude Desktop) as a
             // picker, distinct from tools. Each one is a canned user message that
             // names our own tools by name, so a client with no idea what to ask
@@ -165,7 +166,7 @@ else {
             // Connect stdio transport
             const transport = new StdioServerTransport();
             await server.connect(transport);
-            log("INFO", "Brightspace MCP Server by Rohan Muppa — running on stdio (25 tools, 4 prompts registered)");
+            log("INFO", "Brightspace MCP Server by Rohan Muppa — running on stdio (26 tools, 4 prompts registered)");
             log("INFO", "Setup: see README.md for MCP client configuration (Claude Desktop, ChatGPT Desktop, Cursor, etc.)");
         }
         catch (error) {

package/build/tools/get-upcoming-due-dates.js

@@ -101,6 +101,12 @@ async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
                 continue;
             if (!folder.DueDate)
                 continue;
+            // Check the window before resolving the link: a group folder's link
+            // costs group-membership requests, wasted on an item the handler's
+            // window filter would drop anyway (issue #230).
+            const due = new Date(folder.DueDate).getTime();
+            if (!Number.isFinite(due) || due < from || due > to)
+                continue;
             const link = await assignmentLink(folder);
             items.push({
                 type: "assignment",

package/build/tools/index.js

@@ -23,6 +23,7 @@ export { registerGetDiscussions } from "./get-discussions.js";
 export { registerGetVideoTranscript } from "./get-video-transcript.js";
 export { registerGetServerInfo } from "./get-server-info.js";
 export { registerSearchCourse } from "./search-course.js";
+export { registerSignOut } from "./sign-out.js";
 // Instructor / TA dropbox tools (read-only)
 export { registerGetDropboxFolders } from "./get-dropbox-folders.js";
 export { registerGetDropboxSubmissions } from "./get-dropbox-submissions.js";

package/build/tools/schemas.js

@@ -159,6 +159,7 @@ export const GetMyGroupsSchema = z.object({
         .describe("Course ID to list the current user's project/discussion groups for."),
 });
 export const GetServerInfoSchema = z.object({});
+export const SignOutSchema = z.object({});
 // ── Instructor / TA dropbox tools ──────────────────────────────────────────
 // Read-only, instructor/TA-side views of a course's dropbox (assignment)
 // folders and the submissions inside them. These answer "who has/hasn't

package/build/tools/sign-out.js

@@ -0,0 +1,82 @@
+/**
+ * Purdue Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT — see LICENSE file for details.
+ */
+import { AuthenticationInProgressError } from "../auth/auth-lock.js";
+import { clearSavedSession, RemoveError } from "../auth/logout.js";
+import { log } from "../utils/logger.js";
+import { SignOutSchema } from "./schemas.js";
+import { withUpdateNotice } from "./tool-helpers.js";
+const KEPT = "Kept (if you set them up): your saved password, your settings, and your authenticator key.";
+const OTHER_APPS = "Other Brightspace apps open on this computer are signed out too and will sign in again from scratch on their next question. An app you opened before updating to this version may keep answering for up to an hour; quit and reopen it to sign it out right away.";
+const NEXT_SIGN_IN = "Because your saved password (and authenticator key, if you saved one) stay on this computer, that next sign-in may just ask you to approve it, or finish on its own if you saved an authenticator key. On a shared computer, also delete the saved \"brightspace-mcp-server\" entries from your computer's password store (Keychain Access on a Mac, Credential Manager on Windows).";
+const LOCAL_ONLY = "This only clears this computer. It does not sign you out of Microsoft or Brightspace on other devices.";
+const IN_PROGRESS = "Not signed out: a sign-in is in progress on this computer, so nothing was deleted. If you don't want to sign in, don't approve the prompt. Tell the user to ask again after the sign-in finishes or times out; do not call sign_out again on your own.";
+const ALREADY_SIGNED_OUT = "You're already signed out of Brightspace on this computer; there was no saved session to remove.";
+const UNEXPECTED_FAILURE = "Could not clear the saved session because of an unexpected error. Nothing more was changed; try again, or run `npx -y brightspace-mcp-server@latest auth --logout` in a terminal to see the details.";
+function text(message, isError = false) {
+    const result = withUpdateNotice([{ type: "text", text: message }]);
+    return isError ? { ...result, isError: true } : result;
+}
+/**
+ * Register sign_out tool.
+ *
+ * The in-chat version of `auth --logout`: it deletes this computer's saved
+ * session for the account the server is configured with (clearSavedSession,
+ * under the sign-in lock, so a running sign-in is never disturbed), then
+ * empties the API client's response cache and this process's in-memory token
+ * so it serves nothing from the session it just signed out of. Answers are
+ * plain text, not JSON. A sign-in in progress and an env-supplied credential
+ * are ordinary answers rather than errors, so a model has no reason to retry
+ * in a loop; only a file that could not be deleted is reported as a failure.
+ *
+ * authRunner covers the moment between this server spawning a sign-in and
+ * that child taking the cross-process lock, when the lock alone still looks
+ * free. It is absent when the server uses a pasted credential (no runner).
+ *
+ * clear is an injection seam: tests point it at a temporary directory.
+ */
+export function registerSignOut(server, config, apiClient, tokenManager, authRunner, clear = clearSavedSession) {
+    server.registerTool("sign_out", {
+        title: "Sign Out of Brightspace",
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+        description: "Sign out of Brightspace on this computer: delete the saved Brightspace session, so every Brightspace app here must sign in again from scratch on its next question. Keeps the saved password, settings, and authenticator key. Does not sign out of Microsoft or Brightspace on other devices. Call this ONLY when the user explicitly asks to sign out or log out of Brightspace (a shared computer, handing the machine on). Never call it to fix an error, never as part of answering another question, and never to retry or refresh a sign-in.",
+        inputSchema: SignOutSchema,
+    }, async () => {
+        if (config.envAccessToken || config.envSessionCookie) {
+            return text("Nothing was signed out. This server uses a credential from its configuration (D2L_ACCESS_TOKEN or D2L_SESSION_COOKIE, set in your AI app's client configuration or a .env file), and sign_out cannot remove that. To stop using it, remove that setting and restart the app.");
+        }
+        if (authRunner?.busy())
+            return text(IN_PROGRESS);
+        const dropInMemory = () => {
+            apiClient.clearCache();
+            tokenManager.forgetSession();
+        };
+        try {
+            const { removed } = await clear(config.sessionDir);
+            dropInMemory();
+            if (removed.length === 0)
+                return text(ALREADY_SIGNED_OUT);
+            return text([
+                "Signed out of Brightspace on this computer.",
+                `Removed: ${removed.join(", ")}`,
+                KEPT,
+                OTHER_APPS,
+                NEXT_SIGN_IN,
+                LOCAL_ONLY,
+            ].join("\n"));
+        }
+        catch (error) {
+            if (error instanceof AuthenticationInProgressError)
+                return text(IN_PROGRESS);
+            dropInMemory();
+            if (error instanceof RemoveError) {
+                log("ERROR", "sign_out could not remove a session file", error);
+                return text(`Sign-out is incomplete: ${error.file} could not be deleted, so part of the saved session is still on this computer. Close anything that may be using that file, then ask to sign out again to finish.`, true);
+            }
+            log("ERROR", "sign_out failed", error);
+            return text(UNEXPECTED_FAILURE, true);
+        }
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.13.10",
+  "version": "3.13.12",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",